3

I'm having an issue serving an APK on my server that is using rails. I can serve the APK if the download link is put in /public. However, I want to password protect it. If I move the file behind a URL that requires HTTP authentication, then it will fail on the stock browser with a Download Unsuccessful immediately.

If I install and run firefox, firefox is able to download the APK and install correctly.

Anyone know how to make this work with Android's stock browser?

I have added the MIME Type to the server:

Mime::Type.register "application/vnd.android.package-archive", :apk

And I'm trying to send_file while behind HTTP authentication:

send_file "android.apk", :type => 'application/vnd.android.package-archive'

Successful HTTP-header from /public:

~  curl -s -D- android.apk -o/dev/null
HTTP/1.1 200 OK
Server: nginx/1.4.1
Date: Thu, 11 Jul 2013 20:06:43 GMT
Content-Type: application/octet-stream
Content-Length: 38673086
Last-Modified: Thu, 11 Jul 2013 20:05:12 GMT
Connection: keep-alive
ETag: "51df0ff8-24e1abe"
Accept-Ranges: bytes

Unsuccessful HTTP header from behind HTTP Authentication:

~  curl -s -D- private/android.apk -o/dev/null      
HTTP/1.1 200 OK
Server: nginx/1.4.1
Date: Thu, 11 Jul 2013 20:11:53 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
Status: 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-UA-Compatible: chrome=1 
Content-Disposition: attachment; filename="SironaVideoSurvey.apk"
Content-Transfer-Encoding: binary
Cache-Control: private
Set-Cookie: request_method=GET; path=/
X-Request-Id: 6b99f5e5-87f8-4f8c-816c-0034265b3991
X-Runtime: 0.016140
6
  • By "immediately", do you mean that you are not prompted for authentication? Or that you provide your credentials, and then it fails? Jul 11, 2013 at 19:22
  • Sorry - will update the question to reflect this. I am prompted for authentication first and then the download starts. The download fails right after it starts. The file is simply named '<Unknown> in the download history Jul 11, 2013 at 19:33
  • Could you use curl or something to dump the HTTP headers of a successful request? I suspect that those headers may give us some clues. For example, if the headers include Content-Disposition: Attachment, you may need to make some adjustments to what you are serving: stackoverflow.com/questions/4674737/… Jul 11, 2013 at 19:40
  • Dumping as an edit. Looks like successful from /public is much more simpler in the content-header. I've tried using the suggestion you linked to with no success. I'll try to mimic the content-header /public is serving though Jul 11, 2013 at 20:07
  • A coworker is able to download this using the latest version of Chrome beta (28.0.1500.64) on his Android device. Chrome version 27 though does not. The stock browser with Android 4.2.2 is failing as well Jul 11, 2013 at 20:26

2 Answers 2

5

This looks to be a (~6-year old!!) bug in Android: https://code.google.com/p/android/issues/detail?id=1353

Apparently all we can do is star the issue. There are other hacky workarounds posted around the internet that you can find on your own, but I wouldn't recommend most of them as a general solution.

Perhaps try changing the filename extension to be in all caps, as suggested here: http://www.digiblog.de/2011/04/android-and-the-download-file-headers/

So the line becomes:

Content-Disposition: attachment; filename="SironaVideoSurvey.APK"

If that doesn't work, I would just recommend that you tell your clients to use a different, non-stock (and non-Chrome!) browser. :/ Good luck.

1
  • Thanks for digging up the exact issue! I ended up trying to rename the extension to be in all caps but that didn't work unfortunately. We are serving the APK in a public directory and did our best to hide the URL. The APK doesn't contain any private or sensitive data so we got lucky this time! Jul 22, 2013 at 17:18
0

Serve a login page instead of using HTTP authentication.

With PHP and Apache2, you can do the following:

.htaccess

Options -Indexes
RewriteEngine on

RewriteCond %{HTTP_COOKIE} PHPSESSID=(\w+)
RewriteCond /tmp/access-%1 -f
RewriteRule ^(.*)$ $1 [L]

RewriteCond %{REQUEST_URI} !=/login.php
RewriteRule ^(.*)$ /login.php?req=$1 [L]

You can also put this in the *.conf file in sites-enabled folder of Apache2. If you want to use an .htaccess file, make sure AllowOverride All is enabled in Apache2 config or Apache2 will ignore .htaccess files.

login.php

<?php
$password = "supersecret"; //change this
?>
<!DOCTYPE html>
<html>

<head>
    <title>Site Login</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    <style type="text/css">
        .incorrect {
            color: red;
        }
    </style>
</head>

<body>
    <?php
if (isset($_POST["password"]) && ($_POST["password"] == "$password")) {
    session_start();
    touch("/tmp/access-" . session_id());
    header("Location: /" . $_GET['req']);
} else {
    if (isset($_POST['password']) || $password == "") {
?>
   <p class="incorrect">
        <b>Incorrect Password</b>
        <br>Please enter the correct password
    </p>
    <?php
    } else {
?>
    <p>Please enter the password</p>
    <?php
    }
?>
    <form method="post">
        <p>
        <input name="password" type="password" size="25" maxlength="10">
        <input value="Login" type="submit">
        </p>
    </form>
    <?php
}
?>
</body>

</html>

The strategy is to redirect every request to a login page, except requests from an authenticated session. This includes requests for downloads, images, CSS files, JS files, etc.

The authentication status is communicated from PHP to Apache2 through the use of a temporary file with the session ID in filename (it doesn't have any data, but its existence signals an authenticated session). When the correct password is entered, PHP creates the file. Then any subsequent request will be served as normal by Apache2 if it can detect that the file exists based on the session ID found in the request cookie.

assets/.htaccess

This helps exclude some resources like images and CSS from requiring authentication so that they can be used on the login page. Let's assume they are in an assets folder. Just create assets/.htaccess with the following.

Options -Indexes
RewriteEngine off

Notes

  1. You can adapt the strategy for other scripting languages (like JSP or Ruby on Rails) or web servers (like Nginx). Note that Options -Indexes is optional but recommended as it prevents directory listing.

  2. By default, a session expires after 24 minutes of inactivity. This is defined by session.gc_maxlifetime in php.ini. A logout functionality can be added by using PHP to delete the session's temporary file.

  3. This example is a simple login page with only one password. With the power of PHP you can expand it into any behemoth of authentication management you can imagine. Be it multiple users with usernames, a database storage for user profiles, limited access control, web-based user management, whatever.

  4. Yes, this works with downloads made on the old stock browser of Android, named "Browser" where HTTP authentication fails.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.