403 Forbidden on Android using Nextcloud App

MasterPuffin commented 1 month ago

How to use GitHub

Please use the 👍 reaction to show that you are affected by the same issue.
Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
Subscribe to receive notifications on status change and new comments.

Steps to reproduce

On Android login using the Nextcloud App

Expected behaviour

The Apache server that hosts the IDP should redirect to my login form

Actual behaviour

Apache throws an 403 error. However this only occurs when logging in with the Android app. Using the mobile browser or the desktop app, all works fine. Apache logs the following error

[rewrite:error] [pid 1168:tid 1168] [client XXX:33946] AH10508: Unsafe URL with %3f URL rewritten without UnsafeAllow3F

This seems to be related to https://stackoverflow.com/questions/78729429/403-forbidden-when-url-contains-get-with-encoded-question-mark-unsafeallow3f

Server configuration

Web server: Apache 2.4.62 with Nginx Proxy

MasterPuffin commented 1 month ago

Update: Changing

RewriteRule ^(.*)$ index.php?/$1 [QSA]

to

RewriteRule ^(.*)$ index.php?/$1 [QSA,UnsafeAllow3F]

fixes the issue.

blizzz commented 1 month ago

@tobiasKaminsky Is the app doing something to redirect URLs that the browser engine normally would not?

tobiasKaminsky commented 3 weeks ago

Which urls do you mean?

blizzz commented 3 weeks ago

I think in this case a redirect toward the IdP. But not entirely sure now seeing the server config at https://github.com/nextcloud/user_saml/issues/892#issuecomment-2388003880 It could be a redirect to index.php/apps/user_saml/saml/selectUserBackEnd?redirectUrl= also … but i am also doubting my earlier question now.

tobiasKaminsky commented 3 weeks ago

With login flow v1 we simply follow what server gives us. With v2, everything is done in browser, so any redirect is not controlled by our app.

nextcloud / user_saml