dropbox / dropbox/dropbox-sdk-java

AuthActivity with Firefox's "Tab queue" turned on cancels login flow

未关闭
#242 5 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Java
星标
627
派生
463
平均合并
5 分钟
30 天内合并 PR
10

描述

SDK version: 3.0.8
Android Version: 7.1.1 (didn't test on other versions)

On Android, Firefox's Tab Queue feature causes the web browser login flow to not work due to SDK's `AuthActivity` treating the login flow as cancelled before user runs the login flow.

Repro Steps:
1. Set Firefox as default Browser for Android.
2. In Firefox go to Settings -> General -> Turn on "Tab queue" (which requires grating access Firefox to draw over apps, Settings link should show in Firefox when turning this on for the first time).
3. Invoke SDK's `AuthActivity` from client app with no Dropbox app installed (to invoke browser flow) which causes `AuthActivity` to request Android to launch the login flow URL in a web browser which launches the Firefox browser to open the login flow URL.
4. Due to Firefox's "Tab queue" feature, Firefox opens the login flow URL internally but does NOT show it to the user. Instead it returns right away causing `AuthActivity` in client app to show again while also showing a Toast like UI from Firefox to open the queued URL.
5. User then opens the login flow with the Firefox Tab queue Toast UI which then does show the login flow URL in Firefox now.
6. When user completes login flow in Firefox the web login flow navigates back to client application.
7. Client app's `AuthActivity` when navigated back does nothing because the Dropbox SDK has no token associated with the completed login flow.

The reason for having no token in the Dropbox SDK in step 7 is because in Step 4 when Firefox navigates back to the client app, the Dropbox SDK handles this as a cancelled login attempt and wipes its internal state (same would happen if user task switches back to client app while on Login flow in browser). This logic can be seen in https://github.com/dropbox/dropbox-sdk-java/blob/c710ef80f1c2700031baad7c615dc9934162c090/src/main/java/com/dropbox/core/android/AuthActivity.java#L412 (`onResume()` will be called for the second time when Firefox navigates back to client app while `mAuthStateNonce` is non null -> `authFinished(null)`)

For now I'm advising users who report this to simply turn off Firefox's "Tab Queue" feature or install Dropbox however it would be ideal if this just worked for users.

贡献指南

这个仓库没有索引到贡献指南

调研方向

从所引用行附近的 src/main/java/com/dropbox/core/android/AuthActivity.java 中的 onResume() 开始,跟踪第二次 resume 如何调用 authFinished(null) 并清除状态。使用启用 Firefox Tab Queue 的 Android 7.1.1 重现此问题,然后验证从排队的浏览器登录返回后,已完成的登录仍会与客户端应用关联,而不是被视为已取消。

由索引模型根据 Issue 内容生成。

评估

技术栈
android, java
领域
authentication, mobile
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
42/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。