Network Portal Detection redirect after Login

[Paul Schlacter]

Hi,

Android uses a Network Portal detection using the URL http://clients3.google.com/generate_204. This will return a 204 HTTP response without content when requesting it from the actual Google servers. Captive Portals/Network Portals will return something else (usually a splash page) and keep the requested page URL somewhere in their database. The Android device notices it and shows a notification that this wireless network needs authentication. Pressing this notification will open a browser with the splash page (just by requesting the http://clients3.google.com/generate_204 again). The user can now use some kind of form (e.g. a button) to enter the network. Usually, you will get automatically forwarded by the Network Portal/Captive Portal to the URL you've requested in the first place.

Now here comes the problem:  http://clients3.google.com/generate_204 is a "no content and don't refresh the website view" website. So pressing enter will look to the user like he did not press the "Enter" button or the request failed. This is not really nice and frustrates the user. An obvious way to "fix" it, would be a redirect to another site (e.g. apple.com) when the user pressed enter and was accepted by the Captive Portal/Network Portal. But I am quite sure Android users don't want to get sent to apple.com

What is the recommended way to handle this? Is there some kind of side channel to inform the Android device that is not logged in? Would this automatically close the tab/browser with the splash page? Would it show some other nice "now you are logged it" thing? Should this "just forward the user to another website when http://clients3.google.com/generate_204/http://www.google.com/blank.html was requested" always be used?

Just in case someone is interested: The code to detect splash pages/walled gardens can be found at http://grepcode.com/file/repository.grepcode.com/java/ext/com.google.android/android/4.0.1_r1/android/net/wifi/WifiWatchdogStateMachine.java#WifiWatchdogStateMachine.isWalledGardenConnection%28%29

[Paul Schlacter]

*bump*

Anyone any idea or maybe some hint who I can ask about such information?

[Paul Schlacter]

Maybe the authors of the code can answer my question: 

Irfan Sheriff

Isaac Levy

Jeff Sharkey

Robert Greenwalt

Wink Saville

Yuhao Zheng

[Isaac Levy]

Hi Paul,

This was a couple years ago, but I here's what I recall:

Some captive portals cannot intercept https pages, so to work universally the intent needs to launch an http page.  While google.com might at first seem to be an improvement, this would mean android was regularly launching an insecure google search url, which is not best practice.  generate_204 can take quite a lot of traffic, is neutral, and gives users a chance to detect an MITM ("Wasn't this supposed to be blank?").  An indicator of success is the connectivity icon in the status bar, but I agree also seeing a blank page (depending on your browser) might not be intuitive.

As far as closing the page -- this intent simply launches a URL -- it does not track the progress.  An alternative implementation might be to launch a dedicated webview and close when connectivity manager reports success.  Feel free to file a bug about that (I no longer work on Android, however).  Good luck!

Regards,

Isaac

Isaac

[Paul Schlacter]

Am Freitag, 16. August 2013 14:28:12 UTC+2 schrieb Isaac Levy:

While google.com might at first seem to be an improvement, this would mean android was regularly launching an insecure google search url, which is not best practice.  generate_204 can take quite a lot of traffic, is neutral, and gives users a chance to detect an MITM ("Wasn't this supposed to be blank?").

This information is partially wrong. 204 is not "blank page" but a "no content and don't change the document view" return code. So you would see a splash page, get redirected to the 204 page and then still see the splash page. 

[Дмитрий Захарченко]

Hi all!

So is there a proper way to fix such a behavior? Maybe some patch? I've read too much complaints from Samsung devices owners but there is no answer suitable for me.

Thanks

воскресенье, 18 августа 2013 г., 9:25:53 UTC+3 пользователь Paul Schlacter написал: