Android download manager basic auth

This can be done on server level e. But this is by no means a strong protection. Anybody who is aware of the details can fake the UA and access the download with any normal desktop browser.

The pro is that this allows you to keep basic auth in place and protect a whole section of your website, including web pages and files. The con is that you should only use this technique if a data leak would not get you fired. One important hint about a part of the problem quoting the filename came from this Android bug report:.

If you have also been struggling with the problems mentioned in this article and if you found a solution here, I propose that you fuel the above bug reports especially the second one by clicking the vote star at the bottom of the reporting page above the comment field.

Do you have any experience with the honeycomb browser that comes with Android Tablets? I have a custom ASP. It is possible that the content is your PDF but the name is the filename part of the delivering page.

If the content is really HTML then you probably have a server side problem or a flaw in your download logic which obviously accesses the wrong URL otherwise it would not get the HTML as a response from the server. Again use Live HTTP headers to exactly monitor the headers that are sent from the server to the browser. Then change your code to reduce the headers to the absolute minimum and experiment with variations of the Content-Type and Content-Disposition headers.

Good luck and tell us your findings! I have verified that the download logic is correct by going to my site in IE, Firefox, Chrome, Safari, and on an iPad and downloading the file.

Also, if I omit both of these things it displays the bytes of the pdf in the browser, but once I put either of them in it downloads the html of the page which I found out by opening my download in a text editor. You are at a similar point as I have been some weeks ago.

This is definitely detective work and the solution does not come easy. Could it be that the filename with blanks and additional dots is the problem? Try a very short name. To really get to the bottom of this I recommend finding a way to monitor and analyze the communication between the server and the Android browser much like Live HTTP headers does for Firefox.

If you have access to your Apache access logs this would probably be the first place to look at. To see the whole communication including all HTTP headers and responses you can use a proxy software between your Android and your webserver. Good luck. Thanks for the suggestions. I extracted my code to download the file to a little test site. However, if I download the file after a postback after clicking a download link it downloads the page html instead. So, if I add a second page which just does the download and my link redirects to that page it works, but that seems a bit hacky.

If your downloading from a second page the browser and any intermediate proxy is forced to poll the data from the new URL. If you request the download from the same URL instead, a badly configured proxy might ignore the additional post parameters and just deliver the cached HTML page from the first request. Try additional headers to prevent proxy caching:. You could also take a look at the headers that are sent with the original HTML page these are the ones a proxy will likely remember and obey when the URL is addressed a second time to transfer the PDF.

I stumbled upon the exact same issue myself. Hi John, while FireFox might be a workaround for an individual user, it is no solution for a developer. The websites I create are expected to work flawlessly on any smartphone browser. It just should work out of the box without installing additional stuff.

Upload: I did not test the upload so far. Will probably have to fight with that in my next project… Did you experience any issues with that? Yes there were some issues with the uploads. Uploading via firefox. Firefox renamed the file being uploaded, eg: file. The script would only accept the file being uploaded if it among other things was of the same name it was to replace.

So as FF renamed the dam file to a random string it always refused the upload. Still a little annoying. I just wanted to say thank you for this post. NET 3. We found that the headers had to be added in a specific order Content-Disposition and then Content-Type , the file name MUST be wrapped in quotes as mentioned elseware, we also had to remove underscores and hyphens, and convert the filename and extension to lower case. ToLower Response. First of all thanks for your article.

However the second of the four preconfigurated examples works my phone:. A boiled down version just for your needs params ctaos and cdafqpdf would be:. I had some weird problems in my PHP script whose solution I am sure will help other developers. However, when the content type was set to octet-stream, and I used the POST variables to compound the PDF file name, these variables disappeared magically! Finally just changing the form method from POST to GET the variables were available with octet-stream content-type and the script worked.

I got this problem again, even when I knew it. I have the same problem — mainly with PDF files. Hi Ralf, thanks for your additional insights.

Very welcome! None of these issues seems to be fixed even in the latest Android versions. At least there is no report about it. And GET works great. Why we want to use POST? Security reasons? POST was working well …. Thank you google to wake me up. While GET and POST might seem interchangeable at first glance, there are in fact notable differences between both and also defined W3C recommendations about when to use which of the two.

Is there a client-side solution to this so that I can download from discomfiture websites? Hi Julian, the following list shows which of my four download tests worked for me on my Motorola Defy with two different Android versions and two different browsers:.

So it seems that the success depends on the Android version as well as the browser. Your comment suggests that it additionally depends on the specific Android implementation created by the device manufacturer. Just to make sure: Are your downloads really handled by the default stock browser? Choosing the wrong handler here could be the reason why your trials all fail.

Basically they are doing exactly what I describe here, except for a lowercase extension which again might not work on all Android versions and a specific Mime type that is needed because they download APK packages that must be installed by the OS. I tried everything but still could not design my web page to make a Galaxy Note Gingerbread 2.

The content is not supported on this phone. Did you try to leave that out? It is also not needed for a binary download as the content is not interpreted at download time. Another detail is the all lowercase writing of Content-Disposition in all of your headers.

Did you try to change that? If both does not help: put some demo online and post the URL. I will give it a try. No, you do not need the encoding if you want to download the file.

The encoding would not change the way the binary stream is downloaded and saved, it is just a sequence of bytes which is not interpreted at download time.

In the saved file the encoding information from the HTTP header is lost anyway. Any program that reads the stored file has to assume an encoding or determine the encoding from the content, e.

Please try to get rid of this extra in the header first and see if that helps. My test page is updated. Do you get the same result on your Android device, ie Cannot Download for the first one and the html page for the second one? I have tested your links on a Motorola Defy with Android 2. Both buttons result in a file download with correct name test. In a normal desktop browser both buttons work correctly.

This suggests that there is something going wrong with the form parameters that are sent back to your. NET web app. As the URLs of the original page and the form action for the download are identical Test. It looks like — depending on browser in use — any POST request data gets stripped off when a file download is initiated. This would result in the exact behavior that you describe.

Changing to GET should solve this problem! Hi, first, thank you very much for this awesome post, as it really solves the problem! I followed the instruction in this page and corrected my headers… still, I fail to download a pdf file using androids native browser only opera succeeds. My current headers are after fixing them according to your directions :. Hi Vladimir, how does your download fail exactly? Give some details please.

I also recommend that you terminate your URL by a slash if it is only a path. While most Apache incarnations are configured to add the trailing slash automatically, I definitely would not count on it. After i press on the link, the I get the dialog asking me under what file name to save the attachment and the file name is as expected , but when i click OK start download the download immediately appears as unsuccessful in the downloads screen.

Klicking your link I see that you use basic authentication to secure the path of your files. I am quite sure that this is the problem. As pointed out in the article, some browsers do hand over the download request to the Android Download Manager. This application is surely not aware of the authentication that the browser has negotiated.

Try to disable the authentication for a moment and see if it works then. Anyway, I tried to disable the authentication and it still does not work.

The only option I can offer you is to open up access so I can give it a try from my side. Thank you very mush Jorg!

I finally found the problem. Thank you again for all your help! I hope that this will at least help some more people dealing with this issue. Since Google are not intended to fix this as it seems in the defect record , I guess i will have to change my authentication method just to make it work… any suggestions for a authentication method simple enough and supported by Glassfish 3?

Glad you found the culprit! I will add your findings to the original article tomorrow being a bit stressed today. This can be done on server level at least Apache can do this using. But be warned that this is by no means a strong protection. Anybody who is aware of the details can fake the UA and access the download with a normal browser.

In PHP this header is not required, but accepted. Opera and FF: The header is not required. It works in every browser. But on android stock browser there is a problem, its just opening a normal page with the text displayed on it.

How can i make it download automaticly? But when i put the code in my. I can confirm your problem on Android 2. But I am not sure about the reason. It probably has to do with the fact that you are using IIS on Windows. Here is a comparison of the headers of your server and the headers of a server that sends a working VCF file….

The above header dumps have been logged that way. Problem is with Android phone.. Oh, sorry, tested more and more, found that the problem is with Iframe. Its not giving download if sending page to iframe. Maybe someone will have the same situation. Thank you for your big article and work to help us. Android 2. Hi Hatto, your assumption that the server gets all POST parameters correctly is only partially right. AccessibilityEventFilter UiAutomation.

LayoutParams ActionBar. MemoryInfo ActivityManager. RecentTaskInfo ActivityManager. RunningServiceInfo ActivityManager. AnrInfo ApplicationErrorReport. BatteryInfo ApplicationErrorReport.

CrashInfo ApplicationErrorReport. Query DownloadManager. ActivityMonitor Instrumentation. IconResizer LauncherActivity. Action Notification.

Builder Notification. WearableExtender Notification. BigPictureStyle Notification. BigTextStyle Notification. InboxStyle Notification.

Style Notification. InstantiationException PendingIntent. Added in API level 9. Summary Nested Classes class DownloadManager. Query This class may be used to filter download manager queries.

Request This class contains all the information necessary to request a new download. Public Methods long addCompletedDownload String title, String description, boolean isMediaScannerScannable, String mimeType, String path, long length, boolean showNotification Adds a file to the downloads database system, so it could appear in Downloads App and thus become eligible for management by the Downloads App. Object clone Creates and returns a copy of this Object.

Compares this instance with the specified object and indicates if they are equal. Invoked when the garbage collector has detected that this instance is no longer reachable. Returns the unique instance of Class that represents this object's class. Causes a thread which is waiting on this object's monitor by means of calling one of the wait methods to be woken up.

Causes all threads which are waiting on this object's monitor by means of calling one of the wait methods to be woken up. Returns a string containing a concise, human-readable description of this object. Causes the calling thread to wait until another thread calls the notify or notifyAll method of this object. Causes the calling thread to wait until another thread calls the notify or notifyAll method of this object or until the specified timeout expires. Broadcast intent action sent by the download manager when a download completes.

Constant Value: "android. Intent action to launch an activity to display all downloads. Number of bytes download so far.

Constant Value: "description". The pathname of the file where the download is stored. See Also RFC status codes. Constant Value: "reason". Constant Value: "status". Constant Value: "title". URI to be downloaded. Constant Value: "uri". Constant Value: 0xf0. Request object with: request. Hi, I am trying with this solution and I don't succeed.. My code: — Cristina. Sign up or log in Sign up using Google.

Sign up using Facebook. Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The Overflow Blog. Who owns this outage? Building intelligent escalation chains for modern SRE. Podcast Who is building clouds for the independent developer? Featured on Meta. Now live: A fully responsive profile.