CBL Local server responds "cors":"rejected" on https/http mode. #78

NitzDKoder · 2016-12-23T11:58:01Z

Hi Folks,

Cordova based access to CBL using CBL listener.
https://github.com/couchbaselabs/Couchbase-Lite-PhoneGap-Plugin

2)When applied HTTPS to local server as per below link
https://developer.couchbase.com/documentation/mobile/1.2/develop/guides/couchbase-lite/tech-notes/p2p-replications-ssl/index.html

Any get request from Java-scripts is getting ""cors":"rejected""


	Line 1543: 12-23 17:06:46.901 24666-25270/? D/[HTML5LOG]: ReSTCBL ::: Request started::{"id":"2: GET https://username:password@localhost:portnumber/databasename"}
	Line 1554: 12-23 17:06:46.931 24666-25270/? D/[HTML5LOG]: ReSTCBL ::: Got response::{"id":"2: GET https://username:password@localhost:portnumber/databasename","status":0}
	Line 1556: 12-23 17:06:46.931 24666-25270/? D/[HTML5LOG]: ["cblPtxInterface.launchCBL()-> setupDb()-> Before db GET = ",{"cors":"rejected"},{"seq_id":2,"id":"2: GET https://username:password@localhost:portnumber/databasename","_id":"2: GET https://username:password@localhost:portnumber/databasename","timeoutTimer":23,"statusCode":0},null]
	Line 1556: 12-23 17:06:46.931 24666-25270/? D/[HTML5LOG]: ["cblPtxInterface.launchCBL()-> setupDb()-> Before db GET = ",{"cors":"rejected"},{"seq_id":2,"id":"2: GET https://username:password@localhost:portnumber/databasename","_id":"2: GET https://username:password@localhost:portnumber/databasename","timeoutTimer":23,"statusCode":0},null]
	Line 1558: 12-23 17:06:46.941 24666-25270/? D/[HTML5LOG]: ReSTCBL ::: Request started::{"id":"3: GET https://username:password@localhost:portnumber/databasename"}

4)Router code needs this change? Yet to do this change.

if ("OPTIONS".equals(request.getMethod())){
    response.setStatus(200);
    return true;
}

https://forums.couchbase.com/t/cannot-connect-to-db-lite-couchbase-on-ios-10/10318/6
https://github.com/couchbase/couchbase-lite-java-core/blob/8817e7976427824dcaea5e8687ce20b29cc6e94b/src/main/java/com/couchbase/lite/router/Router.java#L417

PS: Http mode works well.

Thanks
Nithin

The text was updated successfully, but these errors were encountered:

NitzDKoder · 2016-12-23T11:59:51Z

@hideki trying to achieve this below.. pls share your thoughts?

#48 (comment)

hideki · 2017-01-03T20:02:42Z

Hi @NitzDKoder,
I don't know what causes CORS issue. Can you investigate little further by yourself?

NitzDKoder · 2017-01-09T13:32:56Z

@hideki didnt find much on this.. on below use case we see cros issue.

NON- HTTPS CBL listener;
1)Cordova based application(Activity/Service) started and CBL listener is started.Sync works well.
2)Activity and application is stopped by unknown process.
I am_kill : [0,27751,com.XXX.XXX,0,stop com.XXX.XXXs cause from pid 29040]
3) New session created and CBL listener is again started and we see cors error on get request.

@pasin pls share your thoughts on this..

NitzDKoder · 2017-01-10T07:34:25Z

@hideki thanks for the inputs..

"I believe you are using latest CBL v1.3.1 or build from the master branch which uses OkHttp. And you refer 1.2 documentation for SSL. CBL 1.2.x or earlier uses HttpClient. I verified 1.2.x works with SSL. So far, I have not verified if SSL works with 1.3.x or higher. "cors":"rejected" issue might be caused by OkHttp and tjws combination??"

We are using 1.3.1 CBL + okhttp + TJWS.. have not tried in 1.2.x

Thanks
Nithin

NitzDKoder · 2017-03-17T14:47:46Z

@hideki we found the issue.. Basically its not cors issue here..

Problem:

Server was started and was in process of starting.
local URL was formed and get DB request was made, and server was not started yet.
3)All our requests are treated as is_crossDomain true
https://github.com/couchbaselabs/TodoLite-PhoneGap/blob/master/js/modules.js#L1523

need to check the reason yet why true always.

4)As the server was not started and statusCode was 0. CORS was detected.
https://github.com/couchbaselabs/TodoLite-PhoneGap/blob/master/js/modules.js#L1361

// Detect failed CORS requests.
    if(is_cors && xhr.statusCode == 0) {
      var cors_err = new Error('CORS request rejected: ' + options.uri)
      cors_err.cors = 'rejected'

      // Do not process this request further.
      did.loading = true
      did.end = true

      return options.callback(cors_err, xhr)
    }

Pls share your thoughts..

Solution: Make sure server is started and running and then make request.

Thanks
Nithin

hideki · 2017-03-17T17:30:43Z

@NitzDKoder,
JavaScript file is provided as a reference implementation. It might have an issue in the codes. I believe there is a bug in function is_crossDomain(url) method. Can you fix it to return false or throw the exception if the URL is not reachable??

NitzDKoder · 2017-03-24T14:24:20Z

@hideki pls ignore previous problem statement.. Sever gets up immediately after start.

New problem statement.
Use case 1:

Server was started and running.
Https mode and android:debuggable="false"
https://developer.couchbase.com/documentation/mobile/1.2/develop/guides/couchbase-lite/tech-notes/p2p-replications-ssl/index.html
parseRequest method, ServletInputStream returns -1. Socket getting exhausted.

 03-24 09:08:57.449 D/[HTML5LOG]( 3245): ReSTCBL ::hoax requestget
03-24 09:08:57.459 D/[HTML5LOG]( 3245): ReSTCBL ::: Request started::{"id":"1: GET https://:@localhost:33159/ptxdata"}
03-24 09:08:57.579 W/System.err( 3245): [03/24 09:08:57.589] [3] Sync: parseRequest called socketSocket[address=localhost/::1,port=52294,localPort=33159]
03-24 09:08:57.769 W/System.err( 3245): [03/24 09:08:57.774] [3] Sync: parseRequest readLine length :-1
03-24 09:08:57.789 D/[HTML5LOG]( 3245): ReSTCBL ::: Got response::{"id":"1: GET https://:@localhost:33159/ptxdata","status":0}

https://github.com/couchbase/couchbase-lite-java-listener/blob/master/vendor/tjws/src/java/Acme/Serve/Serve.java#L2173

4)All our requests are treated as is_crossDomain true
https://github.com/couchbaselabs/TodoLite-PhoneGap/blob/master/js/modules.js#L1523.

With above 3 problem response statusCode was 0 , CORS was detected.

Use case 2:

Server was started and running.
Https mode and android:debuggable="true"
https://developer.couchbase.com/documentation/mobile/1.2/develop/guides/couchbase-lite/tech-notes/p2p-replications-ssl/index.html

3)Server was able to parse the request and respond to 200 ok.

03-24 09:45:00.189 D/[HTML5LOG]( 3208): ReSTCBL ::: Request started::{"id":"1: GET https://:@localhost:58400/ptxdata"}
[03/24 09:45:05.354] [3] Sync: parseRequest called socketSocket[address=::1/::1,port=37885,localPort=58400]
 [03/24 09:45:05.390] [3] Sync: parseRequest readLine length :-1
 [03/24 09:45:05.458] [3] Sync: parseRequest called socketSocket[address=::1/::1,port=37888,localPort=58400]
[03/24 09:45:05.461] [3] Sync: parseRequest readLine length :23
 [03/24 09:45:05.504] [3] Sync: parseRequest runServlet start
 [03/24 09:45:05.637] [3] Sync: parseRequest runServlet end
-24 09:45:05.659 D/[HTML5LOG]( 3208): ReSTCBL ::: Got response::{"id":"1: GET https://:@localhost:58400/ptxdata","status":200}

android:debuggable="true" vs android:debuggable="false" is making server socket to behave differently.

Pls share your thoughts..

Thanks
Nithin

hideki · 2017-03-24T17:34:16Z

Honestly, I don't know how android:debuggable configuration affects IO, socket, etc Android internally.

https://developer.android.com/guide/topics/manifest/application-element.html#debug

NitzDKoder · 2017-03-25T01:09:41Z

Found this..
https://forum.ionicframework.com/t/https-status-0-in-the-release-build/44512

NitzDKoder · 2017-03-25T01:16:36Z

@hideki this answere..
https://forum.ionicframework.com/t/https-connection-with-self-signed-certificate/12974/12
Need to find proper production hook.

hideki · 2017-03-25T01:22:21Z

Hi @NitzDKoder,
Thank you for sharing links. This is really useful information. And I did not realize it till you shared.
I wonder if any self-signed certificates don't work with a release build?

NitzDKoder · 2017-03-27T13:48:36Z

@hideki yes release android with cordova based app will not work with self singed certificate.
TJWS will accept certificate by Valid CA.?drogatkin/TJWS2#6
That will solve my problem.

Thanks
Nithin

hideki · 2017-03-27T17:38:55Z

@NitzDKoder, I believe that certification verification should be provided by Android (JRE). And TJWS just uses it. Valid certificate should work fine.

https://developer.android.com/training/articles/security-ssl.html

NitzDKoder · 2017-03-28T13:57:09Z

@hideki But we have android webview throwing CN validation issue.(ERR_CERT_COMMON_NAME_INVALID )

Local server URL: https://localhost:18641/data
Certificate CN=*.mycompany.com,

The common name represents the name protected by the SSL certificate. The certificate is valid only if the request hostname matches the certificate common name.

https://support.dnsimple.com/articles/what-is-common-name/

http://stackoverflow.com/questions/138705/security-implications-of-disabling-the-common-name-check-for-https

http://unix.stackexchange.com/questions/138700/is-validation-of-cn-hostname-verification-against-ssl-certificate-required-in-op

Pls share your thoughts...
Is this couchbase-lite-java-listener is production ready?

Thanks
Nithin

hideki · 2017-03-28T17:06:28Z

Hi @NitzDKoder,
For P2P, you could ignore hostname verification by creating custom SSLFactory.

NitzDKoder · 2017-03-29T18:24:55Z

@hideki
https://developer.couchbase.com/documentation/mobile/current/guides/couchbase-lite/index.html
Provides Native APIs for iOS, Android and .NET. With the Native APIs, you can map database documents to your own native object model, work directly with JSON structures, or both. Additionally, apps built with web technologies, such as JavaScript, can use the Couchbase Lite REST APIs to develop hybrid mobile apps.

Here the browser is the client and doing ssl stuffs and throwing the error, so you are saying to add hook at cordova?

Thanks
Nithin

hideki · 2017-03-29T19:33:09Z

@NitzDKoder,
Sorry, I don't know other solutions to fix this ~~without changing SSLFactory~~.

As the error occurs in the browser, so replacing SSLFactory in CBL does not solve the problem.

NitzDKoder · 2017-03-30T04:06:38Z

Ok thanks..
@pasin @jens pls share your thoughts here..

Design:

Cordoava based android app.

https://github.com/couchbase/couchbase-lite-ios/wiki/LiteServ-With-SSL

https://github.com/couchbaselabs/TodoLite-PhoneGap/blob/master/js/modules.js

Android Browser/JavaScript doing xhr https REST requests done to TJWS(java sever with official certificate applied ) and getting SSL error.

Thanks
Nithin

NitzDKoder · 2017-03-31T13:00:06Z

@hideki tweaked cordova to ignore hostname verification. Things are ok now. Will update more soon.

NitzDKoder changed the title ~~CBL Local server responds "cors":"rejected" on https mode.~~ CBL Local server responds "cors":"rejected" on https/http mode. Jan 9, 2017

djpongh added the icebox label Jan 20, 2017

NitzDKoder mentioned this issue Mar 27, 2017

HTTPS in android. drogatkin/TJWS2#6

Open

This was referenced Mar 30, 2017

Phonegap security enchancements #48

Closed

Query: Accessing CBL server from 3rd party application couchbase/couchbase-lite-ios#1520

Closed

djpongh added this to the 1.4.2 milestone Nov 28, 2017

djpongh modified the milestones: 1.4.2, 1.4.x Dec 7, 2017

NitzDKoder mentioned this issue Feb 17, 2019

Android : couchbase-lite-java-listener with XHR request wont work in background in latest chrome. #88

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CBL Local server responds "cors":"rejected" on https/http mode. #78

CBL Local server responds "cors":"rejected" on https/http mode. #78

NitzDKoder commented Dec 23, 2016 •

edited by djpongh

Loading

NitzDKoder commented Dec 23, 2016 •

edited

Loading

hideki commented Jan 3, 2017

NitzDKoder commented Jan 9, 2017 •

edited

Loading

NitzDKoder commented Jan 10, 2017

NitzDKoder commented Mar 17, 2017

hideki commented Mar 17, 2017

NitzDKoder commented Mar 24, 2017 •

edited

Loading

hideki commented Mar 24, 2017

NitzDKoder commented Mar 25, 2017

NitzDKoder commented Mar 25, 2017

hideki commented Mar 25, 2017 •

edited

Loading

NitzDKoder commented Mar 27, 2017

hideki commented Mar 27, 2017 •

edited

Loading

NitzDKoder commented Mar 28, 2017

hideki commented Mar 28, 2017

NitzDKoder commented Mar 29, 2017

hideki commented Mar 29, 2017 •

edited

Loading

NitzDKoder commented Mar 30, 2017 •

edited

Loading

NitzDKoder commented Mar 31, 2017

CBL Local server responds "cors":"rejected" on https/http mode. #78

CBL Local server responds "cors":"rejected" on https/http mode. #78

Comments

NitzDKoder commented Dec 23, 2016 • edited by djpongh Loading

NitzDKoder commented Dec 23, 2016 • edited Loading

hideki commented Jan 3, 2017

NitzDKoder commented Jan 9, 2017 • edited Loading

NitzDKoder commented Jan 10, 2017

NitzDKoder commented Mar 17, 2017

hideki commented Mar 17, 2017

NitzDKoder commented Mar 24, 2017 • edited Loading

hideki commented Mar 24, 2017

NitzDKoder commented Mar 25, 2017

NitzDKoder commented Mar 25, 2017

hideki commented Mar 25, 2017 • edited Loading

NitzDKoder commented Mar 27, 2017

hideki commented Mar 27, 2017 • edited Loading

NitzDKoder commented Mar 28, 2017

hideki commented Mar 28, 2017

NitzDKoder commented Mar 29, 2017

hideki commented Mar 29, 2017 • edited Loading

NitzDKoder commented Mar 30, 2017 • edited Loading

NitzDKoder commented Mar 31, 2017

NitzDKoder commented Dec 23, 2016 •

edited by djpongh

Loading

NitzDKoder commented Dec 23, 2016 •

edited

Loading

NitzDKoder commented Jan 9, 2017 •

edited

Loading

NitzDKoder commented Mar 24, 2017 •

edited

Loading

hideki commented Mar 25, 2017 •

edited

Loading

hideki commented Mar 27, 2017 •

edited

Loading

hideki commented Mar 29, 2017 •

edited

Loading

NitzDKoder commented Mar 30, 2017 •

edited

Loading