Cannot pair Android App with self-hosted instance

[fenech]

Running the app using docker-compose up, I can access the management interface at http://192.168.1.202:8095/manage/

If I try to add a remote POS, I cannot get past the authentication step. I have tried:

• scanning the QR code
• copying the connection URL and entering it manually
  • the URL shown in the UI is hard-coded to use the domain https://drinks.catlab.eu/ (bug?), so I have tried editing the URL to use the same LAN IP:port where the server is running.
  • I also noticed that the token decodes to something like

    {"api":"http:\/\/192.168.1.202:8095","token":"hkjPP0ZjnEw7ihQdrb9YZR1SarRzIKrA"}

    note the backslash-escaped forward slashes. I tried to edit this URL and re-encode the result (base64 + percent-encoding) but it still didn't work

The result is that I am stuck on the initial "Connect Device" page and cannot proceed. Any ideas?

I successfully managed to use the "Open POS on this device" button and pair the laptop where I am testing, so the issue seems to be between the Android App and the server.

[daedeloth]

Hi Fenech

I think the issue might be that your phone can't connect to the local ip address; maybe the firewall or some docker-compose config.

Could you check if the server is accessable from the phone?

I'm also wondering if ssl is required, but not sure about that.

[fenech]

Hi, just tried connecting from my phone and I can access all the pages via the LAN IP:port no problem.

To be clear, that's http://192.168.1.202:8095 with no SSL.

[daedeloth]

Hi fenech

I just checked myself, the issue is indeed the cleartext connection. I'll look into updating the app so that the app allows cleartext connections (with ample warning about the dangers, this is obviously not adviced as this would make it possible to leak access tokens).

However, for development purposes I can see the value :)

I'll post here when the app is released again

[fenech]

OK, thanks a lot. In my use case I was considering running everything in an "air-gapped" environment: mobile device and server on same LAN, with no internet connectivity. I suppose that if I were to enable SSL then I'd run into issues with a self-signed certificate...

[daedeloth]

I've pushed a new android release to public testing channel, you can join here (but it's still in approval phase so might take a bit of time before it becomes available): https://play.google.com/apps/testing/eu.catlab.drinks. You'll also need to update the codebase of this project as otherwise the connection interceptors are overridden.

This version should work with both cleartext requests and self signed certificates; both show a warning that must be accepted before the script loads.

Make sure to properly test things before you use it in a live environment :-) This is a one-man project for now; while I've been using it myself at a couple of events, I can't guarantee there won't be any problems.

Let me know if it works now or if you have any ideas / feedback :-)

[daedeloth]

Any updates? :-)

[fenech]

Hi, I just gave it a try with the beta version installed on my phone.

First I accessed the page on my laptop http://localhost:8095/manage/devices
The QR code scanned correctly and I was presented with the warning screen. I accepted the warning and the connection failed, since it tried to connect to localhost on my phone. My mistake.

So I did it again, this time http://192.168.1.202:8095/manage/devices
The QR code scanned correctly again and no warning was presented, presumably because I had already accepted it previously. However, I ended up stuck on a blank screen. Reloading the app, it remains in this state.

I tried clearing all the app storage and pairing again, but I still end up stuck on the blank screen.

To be honest, now that I have seen that I can install a self-signed cert on Android from the settings, I think I will run a reverse proxy with SSL termination using a self-signed cert. I'll let you know if that works.

[fenech]

I set up a self-signed cert and installed it in Android but it apparently wasn't convincing enough: I still get cert errors in Chrome, Firefox and the warning page in this app. And I don't get past the blank screen that I was seeing before.

[daedeloth]

Thanks for testing! Will look into this asap. I had a security warning from google so I reverted some changes, but I might have broken something. Will test!

[fenech]

I got a subdomain on https://www.duckdns.org/ and configured a valid SSL certificate, but the beta version that I'm testing still complains that the certificate is invalid. I'm connecting using https://[subdomain].duckdns.org:8443 and have a valid cert according to browsers on my laptop and phone.

I tried switching back to the non-beta version of the app and I'm still seeing the "Untrusted Connection" warning when I scan the QR code. I have 0.0.33 installed at the moment and I'm seeing that error still. If I proceed, I see an exception:

java.security.cert.CertPathValidatorException:
Trust anchor for certification path not found.

[daedeloth]

Would it be possible to open the ports and send me the URL when you have the app running, so I can give it a go myself? Not sure what is going wrong, here it seems to work fine :/

[fenech]

In the end, it looks like this was an error in my SSL config. It showed up in the browser as verified but openssl s_client -debug -connect showed errors.

Configuring the server to send the full chain instead of just the cert made it work. I successfully added my phone as a POS device 🎉

In any case, while I was using the invalid cert, it wasn't possible to get past the warning screen.