saladinalep / gametrader

An Android app that notifies you of messages and trade offers on SteamTrades.com
GNU General Public License v3.0
7 stars 0 forks source link

Blank page on Android 6 #2

Open macc0 opened 5 months ago

macc0 commented 5 months ago

Android 6 devices are having issues with websites that use the Let's Encrypt certificate authority, so SteamTrades.com is affected.

The app is showing a blank page, while Chrome reports an ERR_CERT_AUTHORITY_INVALID.

saladinalep commented 5 months ago

This explains the cause of the issue in more detail:

https://community.letsencrypt.org/t/err-cert-authority-invalid-since-a-few-days-on-android-6/214469

One workaround is to bypass SSL certificate checks on Android versions 7.0 and older. Something like:

diff --git a/lib/background.dart b/lib/background.dart
index 1064223..5fae856 100644
--- a/lib/background.dart
+++ b/lib/background.dart
@@ -34,6 +34,10 @@ void callbackDispatcher() {
         initialSettings: InAppWebViewSettings(
           useShouldInterceptRequest: true,
         ),
+        onReceivedServerTrustAuthRequest: (controller, challenge) async {
+          return ServerTrustAuthResponse(
+              action: ServerTrustAuthResponseAction.PROCEED);
+        },
         shouldInterceptRequest: (controller, request) async {
           if (blockedDomains
               .any((domain) => request.url.host.contains(domain))) {
diff --git a/lib/homepage.dart b/lib/homepage.dart
index 1cf0bb1..6b8f3df 100644
--- a/lib/homepage.dart
+++ b/lib/homepage.dart
@@ -216,6 +216,11 @@ class _HomePageState extends State<HomePage> {
                     return null;
                   }
                 },
+                onReceivedServerTrustAuthRequest:
+                    (controller, challenge) async {
+                  return ServerTrustAuthResponse(
+                      action: ServerTrustAuthResponseAction.PROCEED);
+                },
                 onPermissionRequest: (controller, request) async {
                   return PermissionResponse(
                       resources: request.resources,

But there should be a safer way around it.