403 forbidden with simple Android Picasa album list request - android

I'm having a terrible time accessing Picasa from Android. After hours of researching, I finally determined that the Google API Java Client library is what I should be using. Several hours later and I divined that I have to use Mercurial and Maven to download and build a sample client so that I can get certain secret libraries that aren't included in the download instructions. And of course the sample client is in no way compatible with and only slightly resembles that in the Picasa Developer's Guide.
So after much trouble I create a simple URL and try to list albums for a user, using code from the sample client:
PicasaUrl url = PicasaUrl.relativeToRoot("feed/api/user/someuser");
UserFeed userFeed = client.executeGetUserFeed(url);
Now the actual URL this creates is something like:
https://picasaweb.google.com/data/feed/api/user/someuser?prettyprint=true
If I put this in my browser, it works fine. In my Android client, however, it gives me an HTTP 403 forbidden error. And no, I can't even run the sample client, because it doesn't give me an APK file. (Plus the source code isn't documented, is written like spaghetti, and uses deprecated methods.)
After turning on protocol-level logging, it turns out that this is the HTTP request being sent:
GET https://picasaweb.google.com/data/feed/api/user/someuser?fields=author/name,entry(#gd:etag,category(#scheme,#term),gphoto:access,gphoto:numphotos,link(#href,#rel),summary,title,updated),link(#href,#rel),openSearch:totalResults&kinds=album&max-results=3&prettyprint=false
Accept-Encoding: gzip
Authorization: GoogleLogin auth=null
User-Agent: MyApp/1.0 Google-HTTP-Java-Client/1.6.0-beta (gzip)
GData-Version: 2
Where in the Sam Hill did all that crap come from? But you know what? The URL still works in my browser. This must be something about the Authorization: header.
After much more pain, I managed to modify the authentication from the sample so that a notification would appear and allow the user to authenticate the account. Now I'm able to list albums.
But I still don't understand: how can I list the public albums without authentication?

Related

Jhipster Jwt Authentication for Mobile API

I have a jHipster project with Jwt Authentication but I can't get it to work outside de webapp. I'm currently developping a Android application and the authentication process get harder than I expected.
Basically I'm sending the parameters of the LoginDTO, to UserJwtController#authorize ('/api/authenticate'). At first I was getting Unauthorized, both on Android or Postman (I'm using it to test the requests).
If I change the '/api' to permitAll, I'm getting 405, Request method 'POST' not supported.
EDIT
It was a wrong typo on Android :/
It works fine for me against /api/authenticate, so either you use wrong URL (e.g. /api/authorize) or your JSON payload is wrong. The only issue you could have is with CORS. You should consider testing with curl as it is easier than PostMan for reporting here what you really do and also the curl options are already built for you in JHipster swagger page.

403 AuthFailureError in Volley

I am having a very strange situation. I have a running script that makes JsonObjectRequest using Volley Singletone. The script has been working perfectly in domain example1.com. Recently I bought example2.com and hosted in the same hosting account. And when I copy all the php files as it is in the second domain, I am getting error "BasicNetwork.performRequest: Unexpected response code 403".
So, I have exactly same php files called using JsonObjectRequest and Volley Singletone working in example1.com, but not in example2.com. I have check the permission of the files in both domain, they are exactly same (644) and there is no htaccess in either of the domain.
I am stuck and don't understand what else I should check?
Any help will be highly appreciated.
Problem is with your server side php script - You can first try to test POST requests using some tool before implementing in your Android application:
If I performed a simple POST request (just using browser not Android) to your provided link I get following error:
403: Forbidden
403 Forbidden Forbidden You
don't have permission to access /mylibman_4_5.php on this server.
Additionally, a 404 Not Found error was encountered while trying to
use an ErrorDocument to handle the request. Apache
Server at mylibrarymanager.com Port 80

An HTTPS Client for Android that doesn't use native_ssl

Following this issue (that raised this question), and since we didn't get a good answer, we're looking into finding an alternative HTTPS client, one that does not use the Native_SSL library (as we think that the bug is there).
The Problem
We are attempting to use HTTPS with Client Certificate and perform upload of files larger then 44K. During the upload (checked with WireShark) at a cretin point, the server does not get any packets for 2 minutes, and closes the connection, causing a "Connection Reset By Peer".
Alternatives checked / Additional Research
We've checked the Apache Http Client port for android, but it uses the Native SSL library internally.
We've also checked the Chilkat http client, but it also didn't work.
One of the comments (By #DArkO) made to this question caused me to think perhaps the OOB Android HTTP client attempts to perform a multipart upload and fails - and that could be the root cause of all my problems.
So...
What alternative HTTP client would you recommend?
This is a work around - not a solution.
We just could not afford spending any more resources on this issue...
We've dodged the bullet by splitting the upload procedure to 2 steps: First step (which requires the Client-certificate) takes all the metadata and returns an upload token (expires in 30 seconds). Second step does not require the certificate, but uses the upload token to perform upload (still over SSL).

Google Safe Browsing API v2 sample Implementation Android

I am trying to implement a Sample application in Android which gets the malware and phishing list from safe Browsing API and checks the authenticity of URL, this is client side method, but I am constantly getting 400 (Bad Request) as response code when I am trying to hit the URL.
Searched throughout the internet but couldn't get any sample working code.
Even on Developer's Guide page https://developers.google.com/safe-browsing/developers_guide_v2 it is not mentioned how to send the list name correctly in POST request for downloading or updating.
Please help me by providing the correct procedure of how to send list name (if code snippet can be posted, it would be great as I am new to Android.)
Check out that request should end with '\n'. It is common to ignore this. I hope it helps.

What is Apache-HttpClient/UNAVAILABLE error (Android, Google App Engine)?

I am confronting myself with a problem that I do not know how to interpret. I am doing a project using Android and Google App Engine. When I am trying to save information in Google App Engine's Big Table, directly from the servlet (hardcoded) - the save is performed with no problem. But when I am trying to save data from my Android device, the save is not performed and the log indicates Apache-HttpClient/UNAVAILABLE error. To be more specific:
405 55ms 0kb Apache-HttpClient/UNAVAILABLE (java 1.4)
82.155.246.249 - - [10/Jun/2013:05:20:59 -0700] "POST /servletnamehere HTTP/1.1" 405 306 - "Apache-HttpClient/UNAVAILABLE (java 1.4)" "appnamehere.appspot.com" ms=56 cpu_ms=21 cpm_usd=0.000034 app_engine_release=1.8.0 instance=00c61b117cede3f754aa1ece730dc88287a20199
I have seen that 405 HTTP error appears in the context of a POST method ( "405 errors often arise with the POST method. You may be trying to introduce some kind of input form on the Web site, but not all ISPs allow the POST method necessary to process the form." ) => indeed, I am trying to perform add (the object is a JPA Entity) in the database using a POST method. The data I am receiving from my Android device is serialized, through an input stream (in my case, working with JSON is not an option, these are the specifications).
Also, 306 HTTP error reffers to switch proxy. While the porevious error might be a bit intuitive, this one is beyond my student knowledge.
I have followed the instructions of this tutorial (http://trumpy.cs.elon.edu/joel/sigcse2011/), which is indeed what I need, but I really cannot figure out what I did wrong. I took again the procedure, stept by step, but I don't see the flaw.
Any help will be indeed appreciated. If I should post some code, I'll gladly do it.
Best wishes,
Cropcircles
LATER EDIT:
Now I get 417 HTTP error expectation failed. I have seen that I am supposed to set a certain parameter on false, but this workaround was available only for .NET. Is there anyone who knows what's the correspondent of the following, in Java? I am really really confused.
<system.net>
<settings>
<servicePointManager expect100Continue="false" />
</settings>
</system.net>
This is not an answer, but is too long for a comment and may be helpful, so here goes...
First, it's hard to tell what's going on here because there is limited info. Try to post more of the logging either on the client or on the server. Go to the server console and get more info, for instance, or add debugging in the client. I'd start by trying to make the POST from a debug/testing tool like hurl.it: http://www.hurl.it/ (hurl is a nice web front end to a command line HTTP client named curl, see curl itself if you want a more advanced peek). That way you can test and poke around and make SURE your server side works as you expect with a generic client. Then build other clients (like Android).
Second, "Apache-HttpClient/UNAVAILABLE" is not an error, it's just the user-agent String -- so ignore that part. (UNAVAILABLE is where the version typically is, but some impls don't have access to the version sometimes, it seems.)
Third, the 405 response code IS an error, it means POST is not allowed at the server you are trying to POST to. That can either be because POST is not allowed at all on said server, or you're violating some security policy (such as same origin).
If it's AppEngine, first check the APP you are using and make sure it supports POST (look for info on how to do POST at AppEngine to solve, for instance: google app engine: 405 method not allowed). When you say you can do it directly from a "servlet," do you mean that a POST from a different client works? (Servlet is a server side technology, so that's a little confusing.) If so then make sure your Android app is doing the client part the same way to the same host (multipart vs urlencoded, etc).
For a little more on the security stuff, which could be involved, see this post: Google App Engine + jQuery Ajax = 405 Method Not Allowed.
I've had the same trouble and in my case It was an error due to no write permission on server side area.
I was following an android test to write on a file a value transmitted in async way via POST method.
Apache received the POST request but was not able to write the data on the file due to security permission on it.

Categories

Resources