I create a new URLRequest(url: myUrl) object every time before calling URLSession.shared.dataTask(with: urlRequest).
I wait for one request to complete before making another call, so no timing problem possible. If I set it to false, it does not inject cookies. If I set it to true, it does send cookies. So everything is fine? NO!
If you sometimes set it to false for some calls and to true for other calls it will always not inject cookies. So if you set it to false, even if you set it to true for other calls it will never ever work.
I don't know how they manage to create such a bug, but it require some special kind of evil intentions.
Note : I always call the exact same domain and I always have my cookies.