duckduckgo / duckduckgo/Android

[Bug] DuckDuckGo refuses to download files from directories secured with basic auth

Open
#7,844 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs triage
Dominant language
Kotlin
Stars
4.8k
Forks
1.4k
Avg merge
2d 17h
Merged PRs (30d)
170

Description

Describe the bug

Browsing a web page in a basic-auth-secured directory (requesting a login with username and password) I click a document link initiating a file download: in the simplest case a static link to a document in the file system. E.g. a pdf-Doc.

See my test page to verify the bug

How to Reproduce
  1. Enter the secured page and login with username and password
  2. Click the document link
  3. Accept to download the file to the download folder in the DDG dialog

The "download started" message is displayed, then "download failed. check internet connection".

No problems when using Android Chrome or a desktop browser (Chrome, FF).

The web page is accessed from a Apache webserver. The acces log only shows one line for the download (HTTP code 200).

Expected behavior

The document should be downloaded and stored in the download folder

Environment
- DDG App Version: 5.265.0
- Android System Webiew Version: 144.0.7559.109
- Device: Samsung Galaxy XCover 7
- OS: Android 16

Same behaviour on
- Device: Lenovo Tab M10
- OS: Android 110

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure on the linked test page using the reported Android app and WebView versions, then trace the Android download flow for links inside a basic-auth-secured directory. Compare the request and response with Chrome or Firefox; done means the authenticated document downloads successfully and the existing failure message is no longer shown.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.