HTML5 Video does not work on mobile browsers when authenticated - html

I'm using a standard video tag like so <video src="test.mp4" controls>​​</video>. I'm in a SharePoint 2013 environment with NTLM authentication with basic authentication as fall back. The video tag works without issue on all desktop browsers that support HTML5 video.
On mobile browsers, the video tag fails once I authenticate to the site. The video is just static public content that is being served by IIS 8 and is not a part of SharePoint. The only exception so far is Firefox on android, which works without issue. I've removed NTLM auth and switched to basic auth only with the same results.
I've tested so far:
iPad iOS 8 - Safari, Chrome
Android K & L - Chrome, Firefox
Windows Phone 8.1 - IE
The video works as long as I am not authenticated to the host where the video is located. So, if I am at host1 with markup pointing at a video on host2, the video will work until I authenticate to host2.
The video will also work fine if I'm going through a forms based authentication. In my case, I'm using Microsoft TMG.
I've gotten this far with Android Chrome: It will first send a range request with 0-1 byte as expected with Chrome as the user agent. When unauthenticated, it will ask for the rest of the video with stagefright as the user agent. When authenticated, it doesn't send anything and simply fails to play the video. ADB logcat returns this when that happens:
E/StagefrightMetadataRetriever( 183): Unable to instantiate an extractor for 'snipped-video-url'.
E/MediaResourceGetter(11682): Error configuring data source
E/MediaResourceGetter(11682): java.lang.RuntimeException: setDataSource failed: status = 0x80000000
E/MediaResourceGetter(11682): at android.media.MediaMetadataRetriever._setDataSource(Native Method)
E/MediaResourceGetter(11682): at android.media.MediaMetadataRetriever.setDataSource(MediaMetadataRetriever.java:105)
E/MediaResourceGetter(11682): at org.chromium.content.browser.MediaResourceGetter.configure(MediaResourceGetter.java:417)
E/MediaResourceGetter(11682): at org.chromium.content.browser.MediaResourceGetter.configure(MediaResourceGetter.java:259)
E/MediaResourceGetter(11682): at org.chromium.content.browser.MediaResourceGetter.extract(MediaResourceGetter.java:153)
E/MediaResourceGetter(11682): at org.chromium.content.browser.MediaResourceGetter.extractMediaMetadata(MediaResourceGetter.java:125)
E/MediaResourceGetter(11682): Unable to configure metadata extractor
I/MediaFocusControl( 744): AudioFocus requestAudioFocus() from android.media.AudioManager#2ff8d914org.chromium.media.MediaPlayerListener#23b9af5d
D/MediaPlayer(11682): Couldn't open file on client side, trying server side
I/AwesomePlayer( 183): setDataSource_l()
My first thought was it was a Chrome/Safari issue, but IE behaving the same way makes it less likely. Is this by design? Any direction to figuring out what is going on would be appreciated.

Try this
i have a issue which is same as your issue(E/StagefrightMetadataRetriever( 183): Unable to instantiate an extractor for 'snipped-video-url'.).after doing lot of work finally find the way to correct that.
add this line in the manifest of your project
<uses-permission android:name="android.permission.INTERNET" />
Error
After Error

Related

Basic authentication with BackgroundMediaPlayer in WP8.1

Anyone know of a way to access an audio file that is protected with Basic auth when using a BackgroundMediaPlayer in WP8.1?
I've tried using the StreamingRandomAccessStream from How to play a video stream that requires authentication? but it doesn't work with BackgroundMediaPlayer. This is because SetStreamSource() needs to be run from the background agent, and I can't use a HttpClient in a Windows Runtime Component.
EDIT (2015-04-13):
I've now tried using a Windows.Web.Http.HttpClient but it never worked properly because of an apparent bug in the HttpClient stack: https://social.msdn.microsoft.com/Forums/windowsapps/en-US/07e551c1-37c0-4bd9-9d98-aa3fc90df974/windows-phone-8-portable-httpclient-causes-outofmemoryexception-downloading-large-file?forum=wpdevelop&prof=required#5eb62907-92cd-4643-8c74-9e6c2a30e464
The SM.Mono.Net repository has a solution, but doesn't work with files over TLS, which unfortunately makes it unusable for me.

Map issues when testing in IOS 8

I have an application that uses MapBox's API to stylize the underlying map which uses Google Places. This all worked perfectly fine when running in IOS 7+, but when I try testing this in IOS 8, it immediately crashes with the following error message:
Terminating app due to uncaught exception NSInternalInconsistencyException, reason: 'The layout constraints still need update after sending -updateConstraints to MapView at {0,0}-{320x444}.
RMMapView or one of its superclasses may have overridden -updateConstraints without calling super. Or, something may have dirtied layout constraints in the middle of updating them. Both are programming errors.'
I have been looking around the Web and Stack for a while but have been unable to find anything helpful unfortunately. Any suggestions?
I deleted all Mapbox framework / headers / lib from my project and reinstalled the latest (1.4.1) mapbox static library (libMapbox.a) and the Headers, and everything was ok after that without changing a line of my code.

getUserMedia for Firefox OS

It was said that getUserMedia would land on Firefox OS 1.2. I have read the documentation and tried to look for it in the Google Groups, but I have not found anything related to it.
I have developed a web app that works on Firefox Nightly (so, it works in Gecko):
But when I try to use it in Firefox OS 1.4, I get a "Permission denied" error:
I have tried to add the following permission to the manifest:
"permissions":{
"camera":{}
}
But didn't solve the problem. Is there any other permission that I would need to add?
getUserMedia support for the microphone landed in FxOS v1.2. getUserMedia support for the camera just landed on trunk (v1.4) about a week ago. The final piece to land was support for permission prompts : bug 853356 in bugzilla.mozilla.org (https://bugzilla.mozilla.org/show_bug.cgi?id=853356). Prior to a week ago, you would have gotten a permission error.
Currently the camera always returns frames in landscape mode. Bug 970183 (https://bugzilla.mozilla.org/show_bug.cgi?id=970183) tracks that problem, and we're actively working to land a fix for this ASAP.
you need add video-capture permissions in manifest.webapp in 1.4 for getUserMedia video,
and audio-capture permissions in manifest.webapp in 1.2 for getUserMedia audio, ex:
"permissions": {
"audio-capture": {},
"video-capture": {}
}

https from as3 air project to webservice using as3httpclientlib

I am trying to change webservice implementation I have done over to use HTTPS.
I have been using the as3httpclientlib (https://code.google.com/p/as3httpclientlib/).
When I use a non-ssl endpoint it works as expected.
However when I use an SSL endpoint and version 1.3 as3crypt from the downloads page (https://code.google.com/p/as3crypto/downloads/list) or the included as3crypto-1_3_patched.swc I get the following:
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 12
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
I DONT KNOW HOW TO HANDLE DER stuff of TYPE 22
[Fault] exception, information=TypeError: Error #1009: Cannot access a property or method of a null object reference.
With the traces originating from Line 123 of DER.as
https://code.google.com/p/as3crypto/source/browse/trunk/as3crypto/src/com/hurlant/util/der/DER.as?r=7
and the error from line 225 of X509Certificate.as
https://code.google.com/p/as3crypto/source/browse/trunk/as3crypto/src/com/hurlant/crypto/cert/X509Certificate.as?spec=svn28&r=7
When I use the latest version of as3crypt https://code.google.com/p/as3crypto/source/detail?r=28 I get
[Fault] exception, information=Error: couldn't parse DER stream.
Thrown from line 23 of https://code.google.com/p/as3crypto/source/browse/trunk/as3crypto/src/com/hurlant/util/asn1/type/SetType.as
The webservice I am trying to access is on azurewebsites, so will be using the *.azurewebsites.net certificate.
I am also using the ASC2 compiler, this caused a couple of bugs which I had to fix in the crypto project including changing if (hex.length&1==1) hex="0"+hex; to if ((hex.length&1)==1) hex="0"+hex; which I found posted here com.hurlant.util.hex syntax error on air sdk 3.5
I am starting to think it may be something related to the way SSL is done on Azure websites, since when I strip back the request completely, I still get the same error, however pointing to https://www.google.com, I get no error.
They state on their website:
HTTPS doesn't always work. There are some minor bugs with the
as3crypto library, so for example https at yahoo and yahoo owned
domains (like delicious) don't currently work.
I had a look through the list of issues for as3crypt, and was wondering whether one of these contained a fix: https://code.google.com/p/as3crypto/issues/list
Does anyone know why I am getting these errors (what it is that azure are doing differently with their certificate (could it be the wildcard?)) and how I can fix it? Is there a maintained version of as3crypto that works? Or is there a better way for consuming https webservices from Air mobile apps?
****UPDATE****
I tried using the patched version of as3crypto but still no joy. The following is a copy of my stack trace when it errors. Does seem to be an error parsing the certificate?
I also had a look into changing over to SecureSocket but unfortunately it is not supported on iOS.
http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/SecureSocket.html
AIR profile support: This feature is supported on all desktop
operating systems, but is not supported on all AIR for TV devices. On
mobile devices, it is supported on Android, but not on iOS. You can
test for support at run time using the SecureSocket.isSupported
property.
TO RECREATE:
Make a get request to any https subdomain of azurewebsites.net.
ie the following code will reproduce:
var client:HttpClient = new HttpClient();
client.get(new URI("https://httpstest.azurewebsites.net"));
I have the same issue with DER decoing, and fix from this issue helped me:
http://code.google.com/p/as3crypto/issues/detail?id=39
What about:
Or is there a better way for consuming https webservices from Air mobile apps?
You can try to substitute TLSSocket from as3crypto with Flash native SecureSocket in the as3httpclient, I think it shouldn't be too difficult to do. In my project I tryed to use both SecureSoket and TLSSocket and stood on TLSSocket because SecureSoket requires FP 11 and doesn't work with self-signed certificates that we use on test server, but SecureSoket also works fine and has shown even better performance that TLSSocket. You also can grab already patched version of as3crypto from my github (https://github.com/fsbmain/as3public) :)
If you still have problems, please provide endpoint of your webservice so I'll be able test it.
UPD:
I were able to reproduce your issue and tested certificate parsing with my patched as3crypto lib (it still allows to go deeper through the parsing), I also tested parsing of the same certificate but downloaded with the browser - the same result in both cases (as on your screenshot), so the conclusion is that TLSSocket loads correct and full bytes of certificate but fails to parse it. I tried to fix the parsing but it requires deeper dive into the as3crypto DER format implementation. So I'm afraid the only way to use as3httpclient is to fix DER parsing.
BTW why doesn't standard URLLoader fit you?
The as3crypto.swc file here: http://www.igniterealtime.org/downloads/download-landing.jsp?file=xiff/xiff_3_1_0.zip solved my issue.
as3crypto.swc is inside the libs folder, after extracting.

Do Mobile Browsers send httpOnly cookies via the HTML5 Audio-Tag?

I try to play some mp3 files via the html5 audio-tag. For the desktop this works great (with Chrome), but when it comes to the mobile browsers (also Chrome (for Android)), there seem to be some difficulties:
I protected the stream with some password an therefore the streaming server needs to find a special authentification cookie (spring security remember-me). But somehow the mobile browser doesn't send this cookie when it accesses the mp3-stream via the audio tag. When I enter the stream URL directly to the address bar everything works just fine.
While I searched for the lost cookie I found out, that the mobile browser still sends some cookies (e.g. the JSESSIONID) but not all. Further investigations (quick PoC with PHP) revealed that the mobile browsern seems to refuse to send cookies via the audio-tag which have the HttpOnly Flag set. So my question is:
Is this a specified behaviour, why are there differences between the mobile and the desktop versions (of Chrome) and is there a way control the behaviour from the client side?
By looking more deeply into the HTTP packages I found out, that the Android browser doesn't request the mp3-stream itself, but delegates this to stagefright (some android multimedia client). A quick search revealed, that for the old Android versions (before 4.0) stagefright cannot handle cookies:
https://code.google.com/p/android/issues/detail?id=17553 <-- (Status: spam) WTF...
https://code.google.com/p/android/issues/detail?id=17281
https://code.google.com/p/android/issues/detail?id=10567
https://code.google.com/p/android/issues/detail?id=19958
My own tests confirmed this. The old stagefright (Android 2.3.x) doesn't send any cookies at all, the stagefright from a european S3 (android 4.1.2, stagefright 1.2) sends only the the cookies which do NOT have the httpOnly flag.
So I think that everybody has to decide himself which solution he wants to use:
enable httpOnly: android has no access at all but its secure
disable httpOnly: less secure against XSS, but works for Android >4.0
disable cookie authentication at all: insecure but works for all
Note: The problem with simply disabling httpOnly is that you make your whole application vulnerable to cookie hijackers. Another possible solution would be to have a special rememberme cookie for the stream (without httpOnly) and another rememberme cookie with httpOnly enabled.
I had the same problem and disabling HttpOnly or Secure flags on cookies didn't solve the problem on Android 4.2 and 4.4 chrome browser.
Finally I figured the cause. I had a cookie with its value containing special characters colon ( : ) and pipe ( | ), etc. After disabling that cookie with special characters the videos play fine in Android 4.2 and 4.4.
Hope this helps someone.