Custom HTTP Headers

[nikolanovoselec]

I am running the Zipline Admin Dashboard behind Cloudflare. Would it be possible to introduce support for custom HTTP Headers, so the app can access the API, without fiddling with certs and mTLS?

See screenshot as example, from Tautulli.

[smashedr]

So these headers would need to be added to every request?

Would they need to be added before logging in?

This seems pretty simple. I could add the custom header option to the login page and settings page.

[nikolanovoselec]

Exactly. There is normally an "advanced settings" button directly on the login page (and later in the settings) and the headers are simply added to every request.

This way one can create a Cloudlfare Access Policy which permits requests to the origin if the headers are present.

[smashedr]

Yea, this feature seems useful. I will see about getting it added this weekend. I will post any updates or questions on this thread.

[nikolanovoselec]

Here is an example of how this is done in Tautulli, one can add many different headers, simply defining the Header Key and Header Value.

It also works for anything, not only Cloudflare, if the Key and Value can be freely defined.

[smashedr]

Quick update, most of the hard work is done, the UI, just have to implement the headers into the Server API.

I am getting side tracked now, but hope to have this finished and released tomorrow tonight...

I am Beta Testing this now: https://github.com/cssnr/zipline-android/releases/tag/1.0.18-beta.2

PR: #57

ui.mp4

[smashedr]

@nikolanovoselec If you are using GitHub or Obtainium this release, 1.0.18, is live now.

https://github.com/cssnr/zipline-android/releases/tag/1.0.18

It may take a few hours to show up on Google Play, and may take longer.

[smashedr]

v1.0.18 is now live across the board. I'm off to bed tho, but let me know how it works and I will check in tomorrow.

[nikolanovoselec]

Good news is the custom headers work, I see incoming requests on the Cloudflare WAF and the headers pass the Cloudflare Access checks.

I get failed logins to Zipline, maybe because I have 2FA activated, does the app support this?

[smashedr]

Which 2 factor do you use?

Currently it does not support 2 factor. But I can look in that adding this tomorrow.

As a work around you should be able to disable 2 factor and log in and then re-enable 2 factor.

[nikolanovoselec]

I will try that later, now go to sleep. 😜

[smashedr]

Quick update, I added TOTP to the Login. I am working on getting this tested and released now.

PR: #58

totp.mp4

[smashedr]

@nikolanovoselec Two-Factor is now Live in version 1.0.20. I also fixed a random bug on the Custom Headers page from a typo.

Let me know how it goes...

[nikolanovoselec]

I had the initial login using TOTP and custom headers succeed, but once closing the tutorial I got kicked back to the login screen.

Now I cannot log in again, even after deleting the storage / cache.

I get the error you can see on the screenshot.

[smashedr]

That means there was an error parsing the JSON response from the server, at the root.

I am pretty sure it is this line throwing:
https://github.com/cssnr/zipline-android/blob/master/app/src/main/java/org/cssnr/zipline/api/ServerApi.kt#L72

This means the server responded with a 200 response at /api/auth/login but did not include a valid JSON body.

I will do some brainstorming, in the mean time, can you double check your server version by clicking on the version number in the bottom left?

[nikolanovoselec]

I have the latest version.

[smashedr]

Currently I am at a loss. I am using a newer than latest version, but, it was not that simple.

Before this version I was not parsing the login response body. If I can't think of anything I will revert that change and/or update the logging.

But its bedtime again, so I will sleep on it and cut a new release tomorrow.

[smashedr]

I needed to parse the login response to support two-factor, so I took the time to add a debug logging feature i had in the backlog.
PR: #60

In v1.0.21 you can enable logging and view the login response code and body (if successful).

If this does not help us, you will have to provide me access to your server so I can debug the issue since I can not reproduce it locally.
I am on Discord - Shane@111150265075298304

Again, let me know how it goes, and Ill check back later.

[nikolanovoselec]

Hey man. Sorry, I totally forgot about this discussion.

A few days ago I decided to build an app for Zipline with exactly the features I need and here it is - https://github.com/nikolanovoselec/zipline-native.

I decided to go with Flutter, since I keep changing devices and might want to use this on iOS or MacOS at some point (optimized for Android at the moment).

Cheers.

[smashedr]

That is interesting, I am working on a Flutter app myself: https://github.com/cssnr/tibs3dprints-flutter

I am curious however, did you not get the application to work? I can make you a debug build which you can easily view the logs in logcat or android studio.

I have also added a bunch more features and a documentation site: https://zipline-android.cssnr.com/

Either way, cheer and I will check it out...

[nikolanovoselec]

I did get the app to work. It's just that I am very happy with the webapp you made, so rebuilding the whole thing seemed unnecessary to me. I wanted an app that does only the bare minimum, pretty much what the webapplication can't - native sharing support with queueing and clipboard integration. I have implemented this first as a PWA, but since the Web Share Target API is completely broken (it passes URLs, but doesn't work for files), I decided to build it with Flutter.

The only "special" thing I added are the Cloudflare headers and OIDC support. BTW, I had to build a workaround for OIDC, to catch the callback redirect using Cloudflare Workers. Would it be possible to add a "mobile app callback URL" to the Zipline settings, so that Zipline can redirect back to an app, if the OIDC flow was triggered from a native mobile client? This would make my workaround redundant.

BTW2: This link from https://zipline-android.cssnr.com/ throws an error.

[smashedr]

I did get the app to work. It's just that I am very happy with the webapp you made, so rebuilding the whole thing seemed unnecessary to me.

It now has a Native File List with bulk selection and a User/Server Management page.

I wanted an app that does only the bare minimum, pretty much what the webapplication can't - native sharing support with queueing and clipboard integration.

Native sharing support with clipboard integration was the very first feature I added. It also supports uploading multiple files (not sure what queueing is).

The only "special" thing I added are the Cloudflare headers and OIDC support.

MY app should also support Cloudflare headers.

I don't have OIDC support, but nobody has requested that yet.

BTW2: This link from https://zipline-android.cssnr.com/ throws an error.

Awe yes, thanks, I had expected to be live on Google Play by now, but I can't get the few people I know with Android to stop using Obtainium...

If you want to download from Google Play you need to join the test here: #25

---

I do hope you were at least able to upload files natively with the app. It supports both Open With and Share intents. That was the main point of the application. Now it has a native file list with bulk selection, edit, and download. Not to mention a user section, with Avatar cropper and more...

Please do check out these features and let me know if you have any issues.

PS: I had an issue downloading the latest release of your app with Obtainium, it installed v1.0.0 for some reason. I will grab a manual download and test it out, probably tomorrow.