Cookie Security Concern about google-api-objectivec-client

[GoogleCodeExporter]

When you say "Google iOS SDK", which one do you mean?  
https://code.google.com/p/gtm-oauth2/ (or https://code.google.com/p/gtm-oauth/ 
since you said OAuth and not OAuth2).  Or 
https://developers.google.com/+/mobile/ios/?  Or something else?  Just trying 
to make sure we know which specifics you are talking about.

Original comment by [email protected] on 3 Sep 2014 at 2:45

[GoogleCodeExporter]

My bad for not specifying in the original bug, we are in fact using the 
gtm-oauth2 project.  Let me know if you need any additional details.

Original comment by [email protected] on 3 Sep 2014 at 5:25

[GoogleCodeExporter]

The LSOSID cookie by itself, should be an issue.  If you are on the current 
version of the SDK, the GTMOAuth2ViewControllerTouch has methods where we try 
to save/restore the browser cookies before/after the flow so the signin doesn't 
leak to other webview.  You might want to check the flow to confirm that 
controllers viewWillDisappear: is getting called to do the cleanup.

Original comment by [email protected] on 15 Sep 2014 at 8:14

[GoogleCodeExporter]

Developer support for Google authentication services is available via the links 
at https://developers.google.com/accounts/forum

Original comment by [email protected] on 19 Dec 2014 at 2:32

• Changed state: Invalid