dropbox / dropbox/dropbox-sdk-java
AuthActivity with Firefox's "Tab queue" turned on cancels login flow
- 主要语言
- Java
- 星标
- 627
- 派生
- 463
- 平均合并
- 5 分钟
- 30 天内合并 PR
- 10
描述
SDK version: 3.0.8
Android Version: 7.1.1 (didn't test on other versions)
On Android, Firefox's Tab Queue feature causes the web browser login flow to not work due to SDK's `AuthActivity` treating the login flow as cancelled before user runs the login flow.
Repro Steps:
1. Set Firefox as default Browser for Android.
2. In Firefox go to Settings -> General -> Turn on "Tab queue" (which requires grating access Firefox to draw over apps, Settings link should show in Firefox when turning this on for the first time).
3. Invoke SDK's `AuthActivity` from client app with no Dropbox app installed (to invoke browser flow) which causes `AuthActivity` to request Android to launch the login flow URL in a web browser which launches the Firefox browser to open the login flow URL.
4. Due to Firefox's "Tab queue" feature, Firefox opens the login flow URL internally but does NOT show it to the user. Instead it returns right away causing `AuthActivity` in client app to show again while also showing a Toast like UI from Firefox to open the queued URL.
5. User then opens the login flow with the Firefox Tab queue Toast UI which then does show the login flow URL in Firefox now.
6. When user completes login flow in Firefox the web login flow navigates back to client application.
7. Client app's `AuthActivity` when navigated back does nothing because the Dropbox SDK has no token associated with the completed login flow.
The reason for having no token in the Dropbox SDK in step 7 is because in Step 4 when Firefox navigates back to the client app, the Dropbox SDK handles this as a cancelled login attempt and wipes its internal state (same would happen if user task switches back to client app while on Login flow in browser). This logic can be seen in https://github.com/dropbox/dropbox-sdk-java/blob/c710ef80f1c2700031baad7c615dc9934162c090/src/main/java/com/dropbox/core/android/AuthActivity.java#L412 (`onResume()` will be called for the second time when Firefox navigates back to client app while `mAuthStateNonce` is non null -> `authFinished(null)`)
For now I'm advising users who report this to simply turn off Firefox's "Tab Queue" feature or install Dropbox however it would be ideal if this just worked for users.
贡献指南
这个仓库没有索引到贡献指南
调研方向
从所引用行附近的 src/main/java/com/dropbox/core/android/AuthActivity.java 中的 onResume() 开始,跟踪第二次 resume 如何调用 authFinished(null) 并清除状态。使用启用 Firefox Tab Queue 的 Android 7.1.1 重现此问题,然后验证从排队的浏览器登录返回后,已完成的登录仍会与客户端应用关联,而不是被视为已取消。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- android, java
- 领域
- authentication, mobile
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 42/100