TLS handshake error on GrapheneOS

[jmccaull]

Priority/Impact

High (critical issue, blocks workflow)

Description

Description

I cleared app data and tried logging back in. Not sure if this is due to an android update or Ubuntu 24.04 hosting my instance. I access the instance using http behind a VPN. The web ui isn't impacted.

Error details

Error title: An error occurred
Error message: HandshakeException: Handshake error in client (OS Error:
TLSV1_ALERT_INTERNAL_ERROR(tls_record.cc:486))
Stack trace:

#0      _SecureFilterImpl._handshake (dart:io-patch/secure_socket_patch.dart:101)
#1      _SecureFilterImpl.handshake (dart:io-patch/secure_socket_patch.dart:146)
#2      _RawSecureSocket._secureHandshake (dart:io/secure_socket.dart:1009)
#3      _RawSecureSocket._tryFilter (dart:io/secure_socket.dart:1139)
<asynchronous suspension>

Server version

2.4.0a1

Mobile app version

1.8.3,1.8.2

[jmccaull]

Its also happening on a stock pixel 7a so I think its related to ubuntu or a docker update

[jmccaull]

I don't get this error on a fresh install of the wger backend, not sure what the issue could be. I may end up just exporting the database and starting over. I'm having a ton of issues with a local persist volume and permissions.

[jmccaull]

I just reinstalled my instance. Without restore my db backup I get no issues logging in. After restoring and re-downloading images/videos the error returns. Here are the debug logs from the app's requests:
2025-09-10T20:51:32.091541110Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "HEAD /api/v2/routine/ HTTP/1.1" 200 0 "-" "wger App" "-" 2025-09-10T20:51:32.093004939Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "HEAD /api/v2/routine/ HTTP/1.1" 200 0 "-" "wger App" "-" 2025-09-10T20:51:32.104172165Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/version/ HTTP/1.1" 200 9 "-" "Dart/3.8 (dart:io)" "-" 2025-09-10T20:51:32.105868802Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/version/ HTTP/1.1" 200 9 "-" "Dart/3.8 (dart:io)" "-" 2025-09-10T20:51:32.109262066Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/min-app-version/ HTTP/1.1" 200 7 "-" "Dart/3.8 (dart:io)" "-" 2025-09-10T20:51:32.110032261Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/min-app-version/ HTTP/1.1" 200 7 "-" "Dart/3.8 (dart:io)" "-" 2025-09-10T20:51:32.129654902Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/version/ HTTP/1.1" 200 9 "-" "Dart/3.8 (dart:io)" "-" 2025-09-10T20:51:32.151459978Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/language/ HTTP/1.1" 200 1700 "-" "wger App/1.8.3 (de.wger.flutter; build: 80) - https://github.com/wger-project" "-" 2025-09-10T20:51:32.155519938Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/userprofile/ HTTP/1.1" 200 665 "-" "wger App/1.8.3 (de.wger.flutter; build: 80) - https://github.com/wger-project" "-" 2025-09-10T20:51:32.234894150Z 192.168.1.17 - - [10/Sep/2025:20:51:32 +0000] "GET /api/v2/workoutsession/ HTTP/1.1" 200 3040 "-" "wger App/1.8.3 (de.wger.flutter; build: 80) - https://github.com/wger-project" "-"

[jmccaull]

@rolandgeider It seems like this is being caused by pagination during language fetch. This line:

flutter/lib/providers/base_provider.dart

Line 90 in 67241ed

url = Uri.parse(data['next']);

is getting the value ""next" -> "http://x.x.x.x/api/v2/language/?limit=20&offset=20" which is missing the port number. Should this be fixed in the backend? I haven't seen this line get hit by anything else yet.

I'm able to avoid the problem by deleting enough languages that it doesn't page

[jmccaull]

Sorry, it seems like everything paginated has this issue, am I missing a setting?

[rolandgeider]

hey @jmccaull !

how did you setup the application? from searching a bit around I found this answer on stackoverflow, the hostame from the request is the one being used for the "next" item. Perhaps some headers are getting lost somewhere?

[jmccaull]

Sorry, I've changed the port and set the static and media properties to the IP with the port. The server url being used is http://x.x.x.x:2299, I have a number of services hosted on this machine and its has multiple IPs with the full IP:port set in the docker compose file. I may end up just using another static IP specifically for wger to avoid this but that isn't the greatest. The url that is returned in the next property is missing the 2299. Having the clients construct the url instead would couple the client to the format, but then this sort of complexity wouldn't come up right?

[rolandgeider]

I think I found the error, can you update the wger nginx config with this and see if it works for you?

location / {
        proxy_pass http://wger;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_redirect off;
    }

[jmccaull]

@rolandgeider great eye. That did fix the errors and after reading up on host vs http_host I get why. What I'm confused about is how it was ever working before.

The only slightly related thing I'm seeing now is this error related to video playback:
E/ExoPlayerImplInternal( 9374): Caused by: androidx.media3.datasource.HttpDataSource$CleartextNotPermittedException: Cleartext HTTP traffic not permitted. See https://developer.android.com/guide/topics/media/issues/cleartext-not-permitted E/ExoPlayerImplInternal( 9374): at androidx.media3.datasource.DefaultHttpDataSource.open(DefaultHttpDataSource.java:366) E/ExoPlayerImplInternal( 9374): at androidx.media3.datasource.DefaultDataSource.open(DefaultDataSource.java:275) E/ExoPlayerImplInternal( 9374): at androidx.media3.datasource.StatsDataSource.open(StatsDataSource.java:86) E/ExoPlayerImplInternal( 9374): at androidx.media3.exoplayer.source.ProgressiveMediaPeriod$ExtractingLoadable.load(ProgressiveMediaPeriod.java:1045) E/ExoPlayerImplInternal( 9374): at androidx.media3.exoplayer.upstream.Loader$LoadTask.run(Loader.java:421) E/ExoPlayerImplInternal( 9374): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1156) E/ExoPlayerImplInternal( 9374): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:651) E/ExoPlayerImplInternal( 9374): at java.lang.Thread.run(Thread.java:1119) E/ExoPlayerImplInternal( 9374): Caused by: java.io.IOException: Cleartext HTTP traffic to x.x.x.x not permitted

I tried adding the property from the link to the manifest file but it doesn't seem to be reflecting when I debug locally and I'm too tired to spend much time on it at this point as the app seems fully usable. Any chance you know of an easy fix other than setting up https? This isn't exposed over the internet and I'd rather not have to deal with it if possible.

Thanks for the help!

[rolandgeider]

What I'm confused about is how it was ever working before.

same here 😅

As for the video playback, can you visit /api/v2/video/ and /api/v2/exerciseimage/ and see what the the video and image links look like?

[jmccaull]

{
"id": 79,
"uuid": "fff4c294-93f0-4926-b3a2-bf59ad4afaa5",
"exercise": 512,
"exercise_uuid": "00fcf603-b0d0-48d2-9b5e-c7f0d510d46c",
"video": "http://x.x.x.x:2299/media/exercise-video/512/fff4c294-93f0-4926-b3a2-bf59ad4afaa5.MOV",
"is_main": false,
"size": 34332925,
"duration": "10.49",
"width": 1920,
"height": 1080,
"codec": "hevc",
"codec_long": "H.265 / HEVC (High Efficiency Video Coding)",
"license": 2,
"license_title": "",
"license_object_url": "",
"license_author": "Goulart",
"license_author_url": "",
"license_derivative_source_url": "",
"author_history": [
"Goulart"
]
}

[jmccaull]

Images look the same. I'm able to view both through firefox at least

[jmccaull]

I'm actually able to get them to work by adding my IP to android/app/src/main/res/xml/network_security_config.xml:

<domain-config cleartextTrafficPermitted="true"> <domain includeSubdomains="true">x.x.x.x</domain> </domain-config>

[jmccaull]

Adding the cleartext property to base-config in network security config also works without the IP, but it looks like this might get the app blocked from the play store or at least create a warning?