Bartuzen / qBitController

Control qBittorrent from your Android device
GNU General Public License v3.0
493 stars 11 forks source link

Never calls the auth api to login: API returned an error: 403 #26

Closed SebiAi closed 1 year ago

SebiAi commented 1 year ago

Bug description

When I try to connect to my server the app tells me that it encounters an API error 403. (I can log in via the WebUI just fine) After looking at my network logs on my server I can see that the app never talks to the auth API therefore never authenticating itself. Am I doing something wrong?

What I can see the app request on the server (nginx)

"GET /api/v2/torrents/info HTTP/2.0" 403 9 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/tags HTTP/2.0" 403 9 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/categories HTTP/2.0" 403 9 "-" "okhttp/3.14.9"

What my browser does before calling anything else

"POST /api/v2/auth/login HTTP/2.0" 200 3 "https://mycensoredserverdomain.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0"

My qbittorrent-nox instance is behind a nginx proxy which handles the HTTPS connection and I use the username and password I use to login via the WebUI.

Logs

No response

qBitController version

0.4.0

qBittorrent version

qBittorrent v4.3.9 Web UI (64-bit) (qbittorrent-nox)

Android version

12

Additional details

No response

Bartuzen commented 1 year ago

I'm not exactly sure why this issue occurs, but I made a change that will hopfully fix it. Can you try this build and check if its fixed?

junpet commented 1 year ago

I'm not exactly sure why this issue occurs, but I made a change that will hopfully fix it. Can you try this build and check if its fixed?

Had the same problem. The linked build works for me.

SebiAi commented 1 year ago

I'm not exactly sure why this issue occurs, but I made a change that will hopfully fix it. Can you try this build and check if its fixed?

This build does indeed work but it invokes the login 3 times instead of 1 time. Here is my server access log when I first connect to my server and every time I fully close and open the app:

"GET /api/v2/torrents/tags HTTP/2.0" 403 9 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/categories HTTP/2.0" 403 9 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/info HTTP/2.0" 403 9 "-" "okhttp/3.14.9"
"POST /api/v2/auth/login HTTP/2.0" 200 3 "-" "okhttp/3.14.9"
"POST /api/v2/auth/login HTTP/2.0" 200 3 "-" "okhttp/3.14.9"
"POST /api/v2/auth/login HTTP/2.0" 200 3 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/tags HTTP/2.0" 200 2 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/categories HTTP/2.0" 200 2 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/info HTTP/2.0" 200 636 "-" "okhttp/3.14.9"

Just to summarize what I noticed: 1) We wait for all three API calls (tags, catefories, info) to return 403 before we decide to call the login method (maybe call login after the first 403 response code) 2) We invoke the login method three times 3) The app does not save the cookie and needs to login every time the app was fully closed

This is the log when I refresh (pull down to refresh) the stats which is perfectly fine:

"GET /api/v2/torrents/info HTTP/2.0" 200 634 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/categories HTTP/2.0" 200 2 "-" "okhttp/3.14.9"
"GET /api/v2/torrents/tags HTTP/2.0" 200 2 "-" "okhttp/3.14.9"

Edit: Seems like it calls the login method three times because we have three 403 status codes => Fixing 1 should also fix 2

Bartuzen commented 1 year ago

That's because app firstly tries to make API calls (e.g. info). If the server says app is not authenticated, it makes a login call, and then tries to make the first call again. Since these 3 calls occur simultaneously when app starts, they all fail due to authentication, and app tries to make login call for each of them.

The solution is to make each call sequentially. However, this will slow the app. A workaround is to make the login request before first request, since we know that app is not authenticated at that point.

Also, I didn't see the need to save the cookie because it's only valid for an hour, and it doesn't work well with the workaround I explained above.

I will implement the workaround, but I'm closing this issue since the main problem is solved.