title: How does SFAuthenticationSession store session related cookies in Safari
body: <p>tl;dr
  read the last paragraph.</p>
  
  <p>I am using AppAuth (<a href="https://github.com/openid/AppAuth-iOS" rel="nofollow noreferrer">https://github.com/openid/AppAuth-iOS</a>) library for handling OpenID based authentication of users for which I want to provide SSO experience through my app. The deployment target of my app is iOS 11 which means AppAuth internally uses <code>SFAuthenticationSession</code>. I am using authorization flow, which means the user is presented with a web based login page via <code>SFAuthenticationSession</code>. When a user fills in and submits the credentials <code>SFAuthenticationSession</code> calls completion with url (if successful) from which authorization <code>code</code> can be parsed. With the authorization <code>code</code> a token POST request through <code>URLSession</code> is made independently of <code>SFAuthenticationSession</code> and the <code>access_token</code> is retrieved.</p>
  
  <p>The entire flow is successful including the retrieval of <code>access_token</code>, but when I leave the app and open user's profile  webpage provided by the service provider in Safari the user is not logged in. I have tested the same flow with a Google account (<a href="https://accounts.google.com" rel="nofollow noreferrer">https://accounts.google.com</a>) and SSO worked fine, e.g. when I opened <a href="https://mail.google.com" rel="nofollow noreferrer">https://mail.google.com</a> in Safari I was logged in. So I have a suspicion my service provider is doing something wrong. Perhaps they didn't supply me with correct scopes? But before contacting them I want to rule out any fault of mine. Now my most immediate thought is that somehow the session related cookies do not get stored in Safari. From this my question follows.</p>
  
  <p>My question. Token POST request is made independently of <code>SFAuthenticationSession</code> (different user agent) so how any session related cookies get stored on the device (Safari) if not through <code>SFAuthenticationSession</code>? And is there any way to debug cookie storage in code?</p>