#[2.0.0-rc.0] htttp:default permission problems

240 messages · Page 1 of 1 (latest)

hardy scroll
#

I have problem with the http plugin in v2 :
http.fetch not allowed. Permissions associated with this command: http:allow-fetch, http:default
With this mobile config file :

// mobile.json
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-capability",
  "description": "Capability for mobile",
  "webviews": [
    "main"
  ],
  "windows": [
    "main"
  ],
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    {
      "identifier": "http:default",
      "allow": [{ "url": "https://*.tauri.app" }],
      "deny": [{ "url": "https://private.tauri.app" }]
    }
  ],
  "capabilities": [
  ]
}
radiant relic
#

@hardy scroll I meant whether you could show your json after what I asked you to modify

hardy scroll
# 
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-capability",
  "description": "Capability for mobile",
  "windows": [
    "main"
  ],
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    "core:app:default",
    "shell:allow-open",
    "deep-link:default",
    "http:default",
    "http:allow-fetch"
  ],
  "capabilities": [
  ]
}
#

looks like whatever i change in my config file the tauri app don't care

radiant relic
#

remove the http:default

#

have only the allow-fetch

#

@hardy scroll

hardy scroll
#

change nothing

radiant relic
#

could you show where you call the fetch

hardy scroll
radiant relic
#

could you show it

hardy scroll
# 
async get() {
    const urlPath = this.url + this.path;
    console.debug("[HTTPAxios.ts][GET] " + urlPath)
    return await fetch(urlPath, {
      method: "GET",
      headers: HTTPAxios.header
    });
  }

i don't see the problem of the code here. It worked on all other platforms and not the android app

#

this is a config problem

radiant relic
#

but this is a frontend fetch, no? I've been using those the entire time without any limitations

hardy scroll
#

yep frontend

radiant relic
#

hm

hardy scroll
#

import {fetch} from "@tauri-apps/plugin-http";

radiant relic
#

ok what if you don't import fetch there

#

and just use native javascript fetch

hardy scroll
#

fuck it work...

radiant relic
#

?

hardy scroll
#

wtf

#

why did we need http plugin for tauri so ?

radiant relic
#

I'm not sure lol

hardy scroll
#

well the websockets are not working but i will look into this now

cedar yew
hardy scroll
cedar yew
#

Can you try to reproduce it in a new create-tauri-app and if it still happens, open a github issue?

hardy scroll
#

okay let me few minuts

hardy scroll
#

First bug : if you edit a json capabilities file the auto reload will re-boot infinitly (edit the file -> save -> reboot by it self -> again -> again...)
Second behaviour : the fetch work event without the http:default permissions
The fetch work everytimes

#

@cedar yew

#
  • i start from a fresh new tauri - vue - vite project
  • Add http plugin
  • in my app.vue :
<script setup lang="ts">
import Greet from "./components/Greet.vue";
import {onMounted, ref} from "vue";

const response = ref<string>("")

onMounted(() => {
  fetch("http://10.0.2.2:8080/ping", {method: 'GET'}).then(async (r: Response) => {
    response.value = await r.text();
  })
})
</script>
# 
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default",
  "description": "Capability for the main window",
  "windows": [
    "main"
  ],
  "permissions": [
    "core:default",
    "shell:allow-open"
  ]
}
#

I removed the permissions, recompil and the fetch go through without any problems

#

i d'ont understand the behaviour

radiant relic
hardy scroll
#

it doesn't work wathever permission you put

#

but the difference i have two capabilities file :

//desktop.json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "desktop-capability",
  "description": "Capability for desktop",
  "webviews": [
    "main"
  ],
  "windows": [
    "main"
  ],
  "platforms": [
    "linux",
    "macOS",
    "windows"
  ],
  "permissions": [
    "event:allow-emit",
    "event:allow-emit-to",
    "event:allow-listen",
    "event:allow-unlisten"
  ]
}

//mobile.json
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-capability",
  "description": "Capability for mobile",
  "windows": [
    "main"
  ],
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    "core:app:default",
    "shell:allow-open",
    "deep-link:default",
    "http:allow-fetch"
  ],
  "capabilities": [
  ]
}
radiant relic
#

what device are you testing on

hardy scroll
#

mobile

#

android

radiant relic
#

just as a sanity check, what if you give all the jsons http:allow-fetch

hardy scroll
#

don't work with the permissions copy in both file

hollow pivot
#

have you tried to and delete the gen or target folder and re-run pnpm tauri android init to ensure it is not something from a pre-rc build?

hardy scroll
#

huuu interesting i'm tryng

hollow pivot
#

if you have modified the android code somewhere make sure to save it before though

#

the init will re-generate the gen folder containing the mobile projects

#

Also do you have a repro repo to share or is it closed source/a local project?

hardy scroll
hardy scroll
hollow pivot
#

did it btw work in the emulator or are you testing in the emulator?

hardy scroll
#

all tries are done in the emulator

#

@hollow pivot

hollow pivot
#

your cli is still the beta version btw, not sure if this is related but just wanted to mention

hardy scroll
#

i just see this too, i will upgrade it

hollow pivot
#

also some of your capabilities seem not upgraded to rc

#

found several core permissions without the core: prefix

hardy scroll
#

i was in the latest beta when i init the tauri project, and i try to upgrade it to RC

hollow pivot
#

your default.json could cause some issues

hardy scroll
hollow pivot
#

if there is no platform specified it will apply to all platforms afaik and it seems pre-rc

hollow pivot
hardy scroll
#

so i update the cli and then do again the init

#

i guess

hollow pivot
#

yep and then we figure out more 😁

hardy scroll
#

(i commit the update)

hollow pivot
#

hmh desktop is still not using core prefix but that should not be the problem

#

can you add core:default to your permissions just to confirm they are neither needed nor change the issue?

hardy scroll
#

change nothing, i added it in both file

#

i maybe need to use the default file and not trying to use different conf depending the device (for now)

hollow pivot
#

also do you have this configured?

{
      "identifier": "http:allow-fetch",
      "allow": [{ "url": "http://10.0.2.2:24904/auth" }]
}

or http://* should also work

#

hmh you could also remove the default file and just work with specific configs but this shouldn't impact the fetch permission

hardy scroll
# 
"permissions": [
    "event:allow-emit",
    "event:allow-emit-to",
    "event:allow-listen",
    "event:allow-unlisten",
    {
      "identifier": "http:allow-fetch",
      "allow": [{ "url": "http://*" }]
    }
  ],
#

nothing change

hollow pivot
#

core:event

#

it should fail on compile though

#

so I am wondering why it works with event: instead of core:event

hardy scroll
# 
"permissions": [
    "core:event",
    {
      "identifier": "http:allow-fetch",
      "allow": [{ "url": "http://*" }]
    }
  ]

Like this ?
And yes no problem of compilations

hollow pivot
#

can you remove the webviews key btw

#

And yes no problem of compilations
I am confused

hardy scroll
# 
//mobile.js
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-capability",
  "description": "Capability for mobile",
  "windows": [
    "main"
  ],
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    "core:event",
    {
      "identifier": "http:allow-fetch",
      "allow": [{ "url": "http://*" }]
    }
  ],
  "capabilities": [
  ]
}

here's now the file and it compile and still the problem

#

i'm certain i'm missing something somewhere completly stupid but what is it...

cedar yew
#

no i don't think you're missing anything. I think there's a bug in the capabilities handling. I don't think you're the only one with issues like this one.
Today or Yesterday i saw another issue where it looked like "windows": [ "main" ], "platforms": [ "android", "iOS" ], just didn't work. (can't find it rn)

hollow pivot
cedar yew
#

can't remember, trying to find it

hardy scroll
hollow pivot
hardy scroll
#

What do you mean by tauri import ?

hollow pivot
#

import {fetch} from "@tauri-apps/plugin-http";

hardy scroll
hardy scroll
hollow pivot
#

there is no import in the test

hardy scroll
#

huuu

hollow pivot
#

so it uses the built-in fetch of the webview which has nothing to do with our http plugin fetch

hardy scroll
#

well let me retry i guess i say some bullshit

hollow pivot
#

Its late for me here and will go for bed but will retry your pr tomorrow morning on my dev setup

hardy scroll
cedar yew
hardy scroll
#

After some tests, the only difference between my clean install and my app is the auth redirecting part

hardy scroll
#

i'm trying to remove this part to let the user always at the same app base url

hardy scroll
#

Yesterday i try to reproduce it in a clean env with and without auth it change nothing. The clean environement works everytimes i don't understand. I even recreate again the tauri project in my proect without success

#

i cannot help furhter... i will wait for a fix or a solution

#

if you need me dont hesitate to ping me, and if you have news about this issue let me know !

hardy scroll
#

I REPRODUCE THE PROBLEM !!

#

Let me do a simple schema just before

#

Network point of view :

My gess is : when redirecting to "app" Tauri think i'm not on the app anymore but on external url

#

@cedar yew @hollow pivot

#

Now i guess the problem came from me and my workflow solutions. Is it my fault and i need to handle the redirect back in another way or is this a tauri problem ?

#

The question now is : Who to redirect the user to the app ?

hardy scroll
#

when i try to set the redirect url to window.location.origin i get this error on android (but this work on computers device)

image.png
#

I guess this is not the url. I try to just from the tauri app pushing the user to the window.location.origin + random url it work and didn't get the connection refued

#

so it can come from from external source maybe ? ...

hollow pivot
# hardy scroll

I also think I have an alternative suggestion in case the permission is blocking:
Since your are using a Tauri API on the 10.0.2.2 host you could allow the origin in your permissions and add another capability file for this purpose

{
  "identifier": "mobile-capability",
  "description": "Capability for mobile oauth via redirect",
  "windows": [
    "main"
  ],
  "remote": {
    "urls": ["http://10.0.2.2"]
  }
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    {
      "identifier": "http:allow-fetch",
      "allow": [{ "url": "http://*" }]
    }
  ]
}
hardy scroll
hardy scroll
#

And it didn't solve the problem. Same behaviour, when redirecting to http://tauri.localhost throw the connection refused and when redirecting to 10.0.2.2 the fetch is still forbidden

#

i'm surprised i'm the only one uncountering this problem, i'm just trying to implement classic auth system on android version of tauri...

#

am i the first ? (i'm sure no)

hollow pivot
#

ccing @tall magnet

tall magnet
hardy scroll
tall magnet
#

ok i'll check it out

hardy scroll
#

i have an external Keycloak server as i decribed before and a backend to request the ping

tall magnet
#

is that in that repo too?

hardy scroll
tall magnet
#

ok what do i need to do to reproduce it? just run it?

hardy scroll
hardy scroll
tall magnet
#

ok so i guess i should test your branch feature/tauri-integration

#

i wanna get to the bottom of it

hardy scroll
#

And a Auth server like Keylcoak to simulate the auth server redirection

#

keycloak-js is used to handle to auto redirect and user fetching informations

#

i can generate a small docker compose on the testing repo to make sure to reproduce well the problem

#

and a Mockoon file to simulate the backend

tall magnet
#

so just to confirm, is the fetch() error happening after you redirect to http://10.0.2.2:5173?

hardy scroll
#

Yes, not before, just after

#

and i tried to redirect to http://tauri.localhost as i do on all my Tauri computer app but here its not working

hardy scroll
tall magnet
#

right right android is a little different

hardy scroll
#

I maybe don't understand a network part on Android integration that lock my self from the solution

tall magnet
hardy scroll
#

yes point whatever you want, you can even delete it it's for perstance between the down

tall magnet
#

ok i guess it's working now, let's see

#

what is http://localhost:8080/ping supposed to return? is that even reachable now that it's being docker?

#

(trying to reach it from the browser, not even tauri yet)

#

i see i get a resource not found page if i change localhost with my local network address

hardy scroll
#

it just return a string "Pong"

#

The docker don't contain the backend

tall magnet
#

hmm ok

#

so i guess i dont even need the docker 😂

hardy scroll
#

for the keycloak

tall magnet
#

ok so first of all, you need to replace:

"remote": {
    "urls": [
      "http://10.0.2.2"
    ]
  },

with:

"remote": {
    "urls": [
      "http://10.0.2.2:24904"
    ]
  },

then the api call will work
watch and learn @hollow pivot

#

note that you're only allowing fetch to /ping on this example, so for instance i'm getting this error:
Uncaught (in promise) url not allowed on the configured scope: http://10.0.2.2:24904/auth/realms/OnePool/protocol/openid-connect/x

hardy scroll
#

the fetch of /ping work for you ?

#

with this change ?

#

Tauri/Console: File: http://10.0.2.2:1420/ - Line 0 - Msg: Uncaught (in promise) http.fetch not allowed on window main, webview main, allowed windows: , allowed webviews: , referenced by

tall magnet
#

yeah, i'm not using 10.0.2.2:1420 though, i'm redirecting back to window.location.href (i'm still checking how to fix the redirect)

#

to make requests on http://10.0.2.2:1420 you need this:

hardy scroll
#

but in produciton mode those things don't work

#

the redirection still need to be done to the tauri app

#

wich not work with m tries

tall magnet
#

yeah, that's what i'm investigating now

#

but you misconfigured the remote (missing port) so that's why the permission was failing

hardy scroll
tall magnet
#

how are you making that redirect?

hardy scroll
#

to redirect back the user to the app

#

the /#state is added by keycloak

#

i don't use it

tall magnet
#

wait a sec i did get the request now(?) let me investigate more

#

nvm i only get the request when i open the inspector.. i assume the redirect is done by keycloak instead of your frontend right?

hardy scroll
#

exactly

tall magnet
#

ok i have a workaround

#

since the http://tauri.localhost request is a redirect and Android does not let us know about that one, you'll need to start a separate server on the android phone, which will return this html:

<html>

<body>
  <script>
    window.location.href = `http://tauri.localhost/${location.hash}`
  </script>
</body>

</html>

then you'll use that server as redirect url: keycloakStore.init("http://localhost:port");

#

this server will need to be started by your app rust code

#

let me see if i can draft it

hardy scroll
#

that's fell not a good practice this solution

tall magnet
#

not much we can do here.. since android does not let us know about the redirect

#

for dev we can get away with this by using the dev URL directly, but for production... no way

#

@hollow pivot please forgive me and also give my blessing 😂

hardy scroll
#

we are okay that i'm just trying to implement a absoluth normal auth solution

#

i'm suprised to need to do this workaround to solve the problem

tall magnet
#

otherwise more people would've reported this 😐

#

unfortunately that's a limitation of the android platform, so unless there's another way for us to catch network requests.. no other alternative

fast moss
#

So any 302 redirect will end up in an ERR_CONNECTION_REFUSED? Seems a pretty serious thing.
@tall magnet, but how comes that the middleware server you create to redirect can intercept the 302 redirect, but the main app view not?

tall magnet
#

the main app view uses an android api to intercept the redirect and forward the request to tauri itself so tauri can return your bundled asset

#

the localhost server does not need that api

#

i’ll try an alternative

tall magnet
#

ok i think i can fix this on the tauri side

#

will open a pr in a bit

fast moss
#

@tall magnet , thanks a lot. Did not try yet the fix, but thanks a lot for helping

hardy scroll
tall magnet
#

will fix the redirect failing to load

#

then you just need to adapt your code to add the port on the capability

#

and redirect to location.href instead of 10.0.2.2 etc

#

we’ll publish later today

hardy scroll
#

so the server to catch the redirect is no more needed ?

tall magnet
#

nope

hardy scroll
#

Thank you all for your help and your time !

#

And sorry for making you suffer from my poor level of English zrtAlien

tall magnet
#

nah nah you’re alright

hardy scroll
#

On wich release the patch as been pushed, or will be pushed ?

hollow pivot
hardy scroll
#

This a beta rc, i was thiniking it was a simple rc

#

thanks

hardy scroll
#

It work !!

tall magnet
#

one of them affect your demo app, idk why we didn't catch it before

hardy scroll
#

Hello ! Thanks for the feed back, i didn't push further my demo app due to holidays i will check this later thanks you !

kindred scaffold
#

@hardy scroll what is you ended up using? using keycloak, should we separate the auth to another frontend process outside tauri?

hardy scroll
#

Hello, i don't realy understand what you mean by using another frontend for the aut. If you mean by using the trick to create a fake frontend turning in back to handle the auth, nop this is not required. You only need to redirect the user to your auth page and the fallback work since the patch mentionned in few message upper this one

#

But i found some limitation using this system and didn't go furhter to the test

#

And i don't know what is the current state of the art concerning the Authentification process using Tauri, if their is good practice documentation about or anythings else.

#

As i supposed to be since the first launch of the framwork Tauri is made to be a transparant web app compiler so all classic web solutions about auth should work

#

i guess

kindred scaffold
hardy scroll
#

Bu i uses tauri on a Windows use case and i achieve to redirect the user to the auth page without leaving the app. You can look at this project : https://betterfleet.fr

BetterFleet

Unleash your pirating potential in Sea of Thieves by effortlessly creating and managing your alliance. Join forces, dominate the seas, and discover treasures together with our intuitive app. Perfect for players looking to enhance their multiplayer experience and streamline coordination across the vast oceans. Set sail towards victory with Better...

kindred scaffold
hardy scroll
#

Normaly yes, but since the patch mentionned above i didn't go further in the test

#

But the fallback and redirect works

kindred scaffold
hardy scroll
#

It depend on your auth system, here i use Keycloak you only need to setup the IDP