In the Pega SFA application we use control <iframe> for displaying other application. For in-app authentication inside the frame, we need to have a token with the domain of this application in cookies (screen 1). In order to set the necessary cookies, we make an AJAX request:

var xhr = new XMLHttpRequest();
xhr.open("POST", r_path, true);
xhr.setRequestHeader('Content-Type', 'text/plain;charset=UTF-8');
xhr.withCredentials = true;
var body = {
    "adToken": "<%=authToken%>"
};
xhr.send(JSON.stringify(body));

In response to the AJAX request we receive a set-cookie in headers (screen 2). When frame is requested, the token is passed in the cookie header. This works well on the desktop in Chrome, but doesn't work in the native iPad webview app. Also works in mobile Safari with "Prevent cross-site tracking" option disabled. How do we configure webview application to save third party cookies?

Pega 7.3.1 hybridclient-ios- Proprietary information hidden.zip xcode version 10.2.1 iPadOS 14.4.1