Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>By looking more deeply into the HTTP packages I found out, that the Android browser doesn't request the mp3-stream itself, but delegates this to stagefright (some android multimedia client). A quick search revealed, that for the old Android versions (before 4.0) stagefright cannot handle cookies:</p> <ul> <li><a href="https://code.google.com/p/android/issues/detail?id=17553">https://code.google.com/p/android/issues/detail?id=17553</a> &lt;-- (Status: spam) WTF...</li> <li><a href="https://code.google.com/p/android/issues/detail?id=17281">https://code.google.com/p/android/issues/detail?id=17281</a></li> <li><a href="https://code.google.com/p/android/issues/detail?id=10567">https://code.google.com/p/android/issues/detail?id=10567</a></li> <li><a href="https://code.google.com/p/android/issues/detail?id=19958">https://code.google.com/p/android/issues/detail?id=19958</a></li> </ul> <p>My own tests confirmed this. The old stagefright (Android 2.3.x) doesn't send any cookies at all, the stagefright from a european S3 (android 4.1.2, stagefright 1.2) sends only the the cookies which do NOT have the httpOnly flag.</p> <p>So I think that everybody has to decide himself which solution he wants to use:</p> <ul> <li>enable httpOnly: android has no access at all but its secure</li> <li>disable httpOnly: less secure against XSS, but works for Android >4.0</li> <li>disable cookie authentication at all: insecure but works for all</li> </ul> <p>Note: The problem with simply disabling httpOnly is that you make your whole application vulnerable to cookie hijackers. Another possible solution would be to have a special rememberme cookie for the stream (without httpOnly) and another rememberme cookie with httpOnly enabled.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload