nextcloud / nextcloud/user_saml

403 Forbidden on Android using Nextcloud App

Open
#892 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage bug
Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce
  1. On Android login using the Nextcloud App
Expected behaviour

The Apache server that hosts the IDP should redirect to my login form

Actual behaviour

Apache throws an 403 error. However this only occurs when logging in with the Android app. Using the mobile browser or the desktop app, all works fine.
Apache logs the following error

[rewrite:error] [pid 1168:tid 1168] [client XXX:33946] AH10508: Unsafe URL with %3f URL rewritten without UnsafeAllow3F

This seems to be related to https://stackoverflow.com/questions/78729429/403-forbidden-when-url-contains-get-with-encoded-question-mark-unsafeallow3f

Server configuration

Web server: Apache 2.4.62 with Nginx Proxy

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Android app login against Apache 2.4.62 behind the Nginx proxy and inspect the rewrite error containing UnsafeAllow3F. Determine why the Android request is rejected while browser and desktop logins succeed; done means the Android login reaches the IDP login form without a 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, apache, nginx, php
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.