duckduckgo / duckduckgo/Android

[Bug] DuckDuckGo fails to download a file from one-time links

Open
#5,164 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs triage
Dominant language
Kotlin
Stars
4.8k
Forks
1.4k
Avg merge
2d 17h
Merged PRs (30d)
170

Description

Describe the bug

I have a site which hosts one-time links: https://pastacity.nl/?tab=file
After a file (e.g. PDF) is uploaded, it can be downloaded only once, by design of the site. (This is used a simple solution to share with some degree of privacy.)

This approach works well in many browsers, e.g. Firefox and Chrome both on PC and on mobile, but DuckDuckGo fails to download a file from such a link. The reason is that it sends two HTTP requests, both GET. The first GET request causes the link to expire and the second request (actual file download) is not working:

GET /fortune HTTP/1.1
Host: 1.2.3.4:8042
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive
Referer: http://95.216.185.106:8042/api/create
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.36
X-Requested-With: com.duckduckgo.mobile.android


GET /fortune HTTP/1.1
Host: 1.2.3.4:8042
Accept-Encoding: gzip
Connection: Keep-Alive
Cookie: 
User-Agent: ddg_android/5.216.2 (com.duckduckgo.mobile.android; Android API 34)

I think, DuckDuckGo should send the first request as HEAD, because it is a probing request, not expecting to download real data. Then my site (and similar sites) can distinguish the first request as a probe and to prevent data expiry so the second (real) request can successfully download it.

This issue was originally reported to the repo hosting the site: https://github.com/starius/pasta/issues/8#issuecomment-2035362389

How to Reproduce

In DuckDuckGo on Android:

  1. Go to https://pastacity.nl/?tab=file
  2. Select a PDF file
  3. Click on Upload button
  4. Click on the created link
  5. Click on "Save to Downloads" in the popup window
  6. File download failed.



Expected behavior

The file is downloaded back to your phone. (This actually works in other browsers.)

Environment
- DDG App Version: 5.216.2 (52162000)
- Device: Galaxy A73 5G
- OS: Android 14

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the one-time-link download failure in DuckDuckGo on Android using the steps in the issue, then trace the download flow that issues the two GET requests. The work is done when the first probe no longer consumes the link and the file downloads successfully on Android without breaking ordinary downloads.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.