Replies: 13 comments 27 replies
-
|
I love this idea, thank you Eilon! It was just this week where I had to explain all of this to a junior developer and realized that this is not a straight-forward thing for people that are just starting out. It's time we start making this easier. A few things from the top of my head:
|
Beta Was this translation helpful? Give feedback.
-
Right, that's definitely a limitation of the current helper prototype. If at least the concept is interesting, I will try to come up with ways for this to work more seamlessly. I don't think we can fix it 100% for all arbitrary code using any technique like this, because there could be components that hard-code certain things, but, then, they wouldn't work anyway.
Message handlers can be chained, though my current approach doesn't allow for that, so I'll look into making that possible. |
Beta Was this translation helpful? Give feedback.
-
|
Besides @jfversluis perfect answer (especially his first point), I'd like to add to your 4th solution comparison (remote test server & real TLS certificate) that this fails in all my tests, even with public servers like Android Emulator is running with its default image for Android 11 (API level 30), but launching my MAUI app (stripped down to do nothing but send an HTTP GET request to aforementioned domain) fails with a However, the (almost, see below) real culprit occurs a couple of lines earlier where Xamarin's Since GitHub doesn't allow cross-repo inline code, here's the relevant excerpt: try {
_internalTrustManager?.CheckServerTrusted (javaChain, authType);
} catch (JavaCertificateException) {
sslPolicyErrors |= SslPolicyErrors.RemoteCertificateChainErrors;
}As you can see, it does so without adding e. g. the exception's message to So, please, just for the life of me: what do I need to do to improve your gist's code or something inside my own code that I either see the root cause or better yet, get Android's chain validation to succeed? |
Beta Was this translation helpful? Give feedback.
-
|
@Eagle3386 Thanks for the detailed report. If I understand it correctly then the problem was that the custom validation callback was called with |
Beta Was this translation helpful? Give feedback.
-
|
@simonrozsival 100% correct, plus the callback's Regarding your suggestion to file an issue over at xamarin-android, I wonder if that's the optimal place for my issue. Because almost 3 years ago, @buyaa-n seemed to open dotnet/runtime#30522 for Please correct me if I'm wrong & I happily file a new issue over at xamarin-android right away! 😎 |
Beta Was this translation helpful? Give feedback.
-
I'd like to suggest that you add Kestrel's dev cert & create/modify You can get HTH! 😎 |
Beta Was this translation helpful? Give feedback.
-
|
@Eagle3386 I did the following:
I am very sure that you put me on the right track --- but unfortunately, I am still getting exception Hostname 10.0.2.2 not verified.
I am sure there is just some small procedure or trick that I am still missing.... do you have any tips? |
Beta Was this translation helpful? Give feedback.
-
|
@AndreduToit Nah, don't mention it - I'm just glad I was of help to you (at least some, because @davidbritch clarified over at dotnet/docs-maui/issues/600 that my mentioned @Eilon Over at the linked MAUI docs issue, the custom handler code also supports iOS, e. g.: (...)
#elif IOS
return new NSUrlSessionHandler
{
TrustOverrideForUrl = (sender, url, trust) => url.StartsWith("https://localhost")
};
#elif WINDOWS || MACCATALYST
(...)Maybe you want to add it to your helper, too? 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
Hello Eilon, Premises: The problem is that with grpc services DevHttpsHelper it is not working. Some suggestion how setup it ? Thank You |
Beta Was this translation helpful? Give feedback.
-
|
Hmm sorry I'm not sure what that error is. It seems different from the various certificate issues, which is what this guide was aimed at. Maybe there's some other limitation with gRPC and Android when using .NET? Tagging @JamesNK in case maybe he knows something about any such limitation. |
Beta Was this translation helpful? Give feedback.
-
|
As far as I know, .NET on Android doesn't support ignoring invalid certificates. That was true in .NET 6 and I don't think it's changed for .NET 7. I don't know var httpHandler = new GrpcWebHandler(GrpcWebMode.GrpcWeb, new HttpClientHandler()); |
Beta Was this translation helpful? Give feedback.
-
|
@JamesNK it does support some certificate behavior, which is what the Perhaps the issue here is that we need to correctly chain the handlers, which the helper here doesn't yet do. Probably just a few lines of code to have the "ignore SSL stuff" Android handler chain to the gRPC handler and maybe that's all it needs? I'm not sure I have time to test that any time soon, but whoever is affected by this can hopefully test it out and report back. Else, if folks can wait, I'd be happy to try it out myself, but that's a few weeks out at least. |
Beta Was this translation helpful? Give feedback.
-
|
DevHttpsConnectionHelper isn't being used with gRPC. Change this: var httpHandler = new GrpcWebHandler(GrpcWebMode.GrpcWeb, new HttpClientHandler());To this: var devSslHelper = new DevHttpsConnectionHelper(sslPort: 7192);
var inner = devSslHelper.GetPlatformMessageHandler();
var httpHandler = new GrpcWebHandler(GrpcWebMode.GrpcWeb, inner); |
Beta Was this translation helpful? Give feedback.
-
|
_ made following changes as per your suggestions, So in windows works, but in Android the same error reported before. To answering to Eilon, would be good if you could try by yourself, if you could share a private address I could send to you the link where to download the entire project to test directly on it. Bye Piercarlo |
Beta Was this translation helpful? Give feedback.
-
|
I would be fine with developing on HTTP locally, as it works well (once you deal with the IIS Express binding issues). However the problem is that in a real world application you often have remote resources such as images, CSS, or JavaScript which are referenced in the component markup (not all resources can realistically be bundled with an app and be served natively on the device). Currently the BlazorWebView starts up on https://0.0.0.0 which means that references to remote resources also need to use https:// or else you get Mixed Content error messages when it attempts to load the resources - which results in a broken experience. So basically in order for local HTTP development to be fully effective, there would need to be a way to startup the BlazorWebView on http:// rather than https:// - or there needs to be a switch for enabling MixedContent (I believe the Xamarin Forms WebView had such a switch). |
Beta Was this translation helpful? Give feedback.
-
|
Nobody should be "fine developing on HTTP" instead of HTTPS in any language, technology or system - ever again! Besides, who wants to use IIS Express when there's Kestrel available? |
Beta Was this translation helpful? Give feedback.
-
Why use kestrel when you can just use IIS, and then your dev system is essentially the same as your production servers? Also, you get a win with the devs knowing more about how to configure and work with IIS, which translates into production server management skills. |
Beta Was this translation helpful? Give feedback.
-
|
This issue better describes the issue I was referring to with BlazorWebView and resource URLs #10898 |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Eilon Thanks very much for your documentation of this + your connection helper code - it has resolved almost all of my untrusted certificate issues. The only problem that I have left is around loading images - I have created an image object and have set the Source to https://someip/someimage.jpg and Glide won't load it due to the trust anchor issue (see below). Do you know if there some way to make Glide use a DevHttpsConnectionHelper to get around this problem? Cheers Andrew |
Beta Was this translation helpful? Give feedback.
-
|
@smitha-cgi Just was wondering if you got a solution for this. Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
No, I never did. Had to fall back to using HTTP URLs to get images to work. |
Beta Was this translation helpful? Give feedback.
-
|
@smitha-cgi Okay. Thanks for the response. I'm using the "dev tunnels" which is working great. The nice thing about "dev tunnels" is you can connect your local host to any external devices including your physical devices that are connected to the same network which I think is awesome! |
Beta Was this translation helpful? Give feedback.
-
|
@Eilon Thanks a bunch for this tutorial. This is working great with the http client on the maui app. However it still throws an error on Android while loading the images using "Image" control. These images are accessible via local host & ipv4 address. Just was wondering if you have some kind of guidance to get this working. Also see Andrew's ( @smitha-cgi ) post above. I'm getting exact same error message. Thank again in advance! |
Beta Was this translation helpful? Give feedback.
-
|
I am using WebView to show my webpage in my android app like this (the webpage is already published in my local server). |
Beta Was this translation helpful? Give feedback.
-
|
By the way, I am using NET6 now |
Beta Was this translation helpful? Give feedback.
-
|
Tricking SSL into being okay with an invalid cert feels to me like a bad option, even in development. Its too easy to accidentally forget its there, or the flag gets set wrong in config and goes out to production or something. Since my production server is only available via HTTPS and my dev one by HTTP, I just made the app "okay" with HTTP traffic. UsesCleartextTraffic allows for insecure HTTP requests to work. |
Beta Was this translation helpful? Give feedback.
-
You could wrap this in an //Uses clear traffic is required for HTTP development traffic
#if DEBUG
[Application(UsesCleartextTraffic = true)]
#endif
public class MainApplication : MauiApplication
{Though, this means that you wouldn't be able to test your "release" build against your dev server. But that would mitigate the risk of dev code making its way to production. |
Beta Was this translation helpful? Give feedback.
-
|
This is a great idea. |
Beta Was this translation helpful? Give feedback.
-
|
I recently ran into an odd issue. In my app I used a <?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system" />
<certificates src="user" />
</trust-anchors>
</base-config>
</network-security-config>I went to release the app and during the Android app review process, I was asked to wrap the So I did, and the app release went through. <?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<debug-overrides>
<trust-anchors>
<certificates src="system" />
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</base-config>
</network-security-config>However, when I try to debug the app now, I always get this error: Is there something wrong in the MAUI build process that causes it to not activate the functionality of Android's |
Beta Was this translation helpful? Give feedback.
-
|
This is extermely helpful for me. I have been trying to fix the below issue in MAUI app and nothing helped me.
Strangly the below code works for me one solutio but not in the other solution Thanks you @Eilon |
Beta Was this translation helpful? Give feedback.
-
|
I am still looking for exact solution for this: |
Beta Was this translation helpful? Give feedback.
-
|
Here is an updated version for all 4 platforms: ios, android, win, mac https://gist.github.com/yurkinh/e14a3ea8724e186df5dc7b4b37bb6511 |
Beta Was this translation helpful? Give feedback.
-
|
That code doesn't really improve, because you:
Hence: the only benefit of your code can be simplified to this:
|
Beta Was this translation helpful? Give feedback.
-
|
I tried to run a maui app that uses azure mobile apps in an emulator with its backend on a local machine and faced the same issue. This library doesn't allow plain http connections and I couldn't find a way to use connection helpers with it. What worked for me is creating a self-signed cert and configuring the android app and kestrel to use it. UPD: |
Beta Was this translation helpful? Give feedback.
-
Background
Hi everyone,
A common scenario for .NET MAUI apps is to have a multi-platform client app that connects to a server, which often runs on ASP.NET Core. One of the challenges today is that Android emulators don't trust the HTTPS SSL certificate used by ASP.NET Core, because ASP.NET Core uses a local development certificate, and causes HTTPS connections to fail.
I decided to make a new attempt at fixing this problem, and comparing it to other existing or experimental solutions.
Exceptions you might be hitting
How do you know if this affects you? Aside from the API calls not working, you'll typically see one of these exception messages in the output window of Visual Studio:
javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.Hostname 10.0.2.2 not verifiedSolution comparison
Here are the solutions I'm aware of:
Experimental HTTPS connection helpers
While working on a sample app, I developed some helpers that I wanted to share and get feedback on. The helper takes in some basic settings, such as
var devSslHelper = new DevHttpsConnectionHelper(sslPort: 7155);, and then offers some helper methods to establish HTTPS connection that work from an Android emulator (in addition to working elsewhere).Android Emulator calling ASP.NET Core web API
To use the helper to make an HTTPS connection to a local server, such as to call a web API, here's what you would write:
Android Emulator connecting ASP.NET Core SignalR hub
To use the helper to make a SignalR connection, you would write:
How it works
The helper has platform-specific code that configures connections properly to work on each platform (right now only Windows and Android are supported; iOS and MacCatalyst will follow). On Android, the helpers handle certain SSL Certificate checks by indicating that the ASP.NET Core Development Certificate should be trusted, and to allow the HTTPS connection attempt to succeed. Without this logic, the self-signed certificate would be considered untrusted, and the connection would fail.
How to use the connection helpers?
These are experimental helpers, so it involves adding some code to your project. First, copy this code into a new file in your app: https://gist.github.com/Eilon/49e3c5216abfa3eba81e453d45cba2d4
And then use the code seen above to make web API or SignalR connections to your server.
Comparison table
This table summarizes the pros/cons of each approach:
Other resources
The .NET documentation includes some relevant resources:
Feedback
We'd love to hear whether you've run into issues like this and if any of these solutions are interesting to you.
This is a work in progress, so please share your questions, comments, concerns, and any other thoughts on this!
Thank you for reading this,
Eilon
Beta Was this translation helpful? Give feedback.
All reactions