duckduckgo / duckduckgo/Android
[Bug] DuckDuckGo fails to download a file from one-time links
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 4.8k
- Forks
- 1.4k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 170
Description
Describe the bug
I have a site which hosts one-time links: https://pastacity.nl/?tab=file
After a file (e.g. PDF) is uploaded, it can be downloaded only once, by design of the site. (This is used a simple solution to share with some degree of privacy.)
This approach works well in many browsers, e.g. Firefox and Chrome both on PC and on mobile, but DuckDuckGo fails to download a file from such a link. The reason is that it sends two HTTP requests, both GET. The first GET request causes the link to expire and the second request (actual file download) is not working:
GET /fortune HTTP/1.1
Host: 1.2.3.4:8042
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive
Referer: http://95.216.185.106:8042/api/create
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.36
X-Requested-With: com.duckduckgo.mobile.android
GET /fortune HTTP/1.1
Host: 1.2.3.4:8042
Accept-Encoding: gzip
Connection: Keep-Alive
Cookie:
User-Agent: ddg_android/5.216.2 (com.duckduckgo.mobile.android; Android API 34)
I think, DuckDuckGo should send the first request as HEAD, because it is a probing request, not expecting to download real data. Then my site (and similar sites) can distinguish the first request as a probe and to prevent data expiry so the second (real) request can successfully download it.
This issue was originally reported to the repo hosting the site: https://github.com/starius/pasta/issues/8#issuecomment-2035362389
How to Reproduce
In DuckDuckGo on Android:
- Go to https://pastacity.nl/?tab=file
- Select a PDF file
- Click on Upload button
- Click on the created link
- Click on "Save to Downloads" in the popup window
- File download failed.
Expected behavior
The file is downloaded back to your phone. (This actually works in other browsers.)
Environment
- DDG App Version: 5.216.2 (52162000)
- Device: Galaxy A73 5G
- OS: Android 14
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the one-time-link download failure in DuckDuckGo on Android using the steps in the issue, then trace the download flow that issues the two GET requests. The work is done when the first probe no longer consumes the link and the file downloads successfully on Android without breaking ordinary downloads.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100