title: iOS sporadically sends old cookies
body: <p>I have an application that rotates an auth token cookie values regularly.</p>
  
  <p>Each time the server rotates the token, it will not mark it as "good" until it sees the client has the token (cause the client includes it in the request headers for a resource). </p>
  
  <p>I have a very specific situation ONLY on iOS (10.3) where sporadically it will send a very old cookie when network conditions change (eg: get off the subway). When this condition hits it "forgets" about the most recent cookie value and "starts living in the past" and sends and old value.  </p>
  
  <p><a href="https://i.stack.imgur.com/TLV7F.png" rel="noreferrer"><img src="https://i.stack.imgur.com/TLV7F.png" alt="log"></a></p>
  
  <p><sup>** Security note: IP addresses are publicly allocated t-mobile in NYC and token has long been deleted from our DB</sup></p>
  
  <ul>
  <li>Is this a known issue?</li>
  <li>Are there any workarounds for cookie handling that is more robust on iOS? localstorage is not ideal cause these cookies are http only.  </li>
  </ul>
  
  <p>To clarify ... this is the flow:</p>
  
  <ol>
  <li>Client (iOS Safari) has a cookie called <code>_t</code> with the value <code>old</code></li>
  <li>Client (iOS Safari) makes a request to the server</li>
  <li>We issue <code>Set-Cookie</code> and set <code>_t</code> cookie to a new value <code>new</code> (http only, secure cookie) </li>
  <li>Client makes another request with the new cookie value <code>new</code>. We flag that the cookie value is good and client has it. </li>
  <li>Time passes</li>
  <li>Client makes a request with the <code>_t</code> cookie with the value <code>old</code></li>
  </ol>