Android app server url does not support HTTP basic authentication

[diafygi]

Description

---

When adding HTTP basic access authentication to the nginx config, the server url in the mobile app settings removes the credentials and does not work. However, the authenticated server url works perfectly when using a desktop browser. Also discussed here: https://community.jitsi.org/t/enabling-http-authentication-using-docker-jitsi-meet/32797/2

Current behavior

---

In the Android app > Settings > Server URL, if I try to input a server url that includes basic credentials (e.g. https://user:pass@meet.mydomain.com/) the app automatically changes the url to remove the username and password (e.g. https://meet.mydomain.com/).

Expected Behavior

---

The server url should be able to handle http basic username/password values in the server url.

Possible Solution

---

Enable HTTP basic auth support for the mobile apps in server urls.

Steps to reproduce

---

1. Create a basic username password file.

echo "myuser:mypassword" > /path/to/my.htpasswd

2. Add HTTP basic authentication to the default nginx config so that users are asked to authenticate

server {
    listen 443;
    ...

    auth_basic "Login Required";
    auth_basic_user_file /path/to/my.htpasswd;

    ...
}

3. Verify the authentication works using a server url with basic auth credentials.

Open in browser: https://myuser:mypassword@meet.mydomain.com/

4. Open the Android/iOS app and try to set the authenticated server url in your settings.

Settings > Server URL > https://myuser:mypassword@meet.mydomain.com/

5. The app removes the basic auth credentials and isn't able to connect to the server.

https://myuser:mypassword@meet.mydomain.com/ --> https://meet.mydomain.com/

Environment details

---

Tested on Android app 20.2.3 build 4129209

[saghul]

The mobile apps are not browsers, thus they won't repond to HTTP auth. If you want to protect your deployment with authentication you should use XMPP authentication, which Jitsi Meet supports: https://github.com/jitsi/jicofo/#secure-domain