3 ms·
The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to a
by xenadu02 10y ago
The worst code I ever had to write was captive portal detection for the PlanGrid app.
I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms race where Apple adds new domains to iOS but doesn't start using them until a certain date to evade the whitelist.
The stated reason for this stupidity? The mini-browser that pops up doesn't work with their stupid captive portal login or payment page. Fix the page? Nahhh, let's just fuck everyone's network connections instead. It caused an endless barrage of battery-draining network errors, eating the retry count and eventually causing POST requests to error out. The complete lack of respect for the users, internet protocol standards, etc was extremely evident.
We ultimately stuck a file with a specific phrase in a text file on the site, then when the app was having network trouble the code tries to fetch that file. If it gets an HTML response it marks it as in captive portal mode. IIRC it offered to take the user to safari and would open some non-HTTPS URL so the captive portal redirect could fire and let the user know.
I hope anyone trying to circumvent captive portal detection dies a very painful death, then gets revived, recovers through the miracle of modern medical technology, then dies another painful death.
- innocenat 10y agoApple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.
- anon363764 10y agoWhen iOS cannot fetch the fixed content of www.thinkdifferent.*, a UIWebView pops and displays that content, assuming it's a captive portal needing attention. Instead, there should be some non-routable, local-only special IPv4/IPv6 address that all captive portals are required to present. No more DNS spoofing, no more page rewriting which breaks the web.
- kristofferR 10y agoThe mini-browser (Captive Network Assistant) is designed to protect the user's privacy, so support for Javascript and cookies is deliberately disabled.
- richrichardsson 10y agoJavascript IS enabled in CNA!
- sangnoir 10y agoAndroid detects wifi with captive portals automatically and pops-up a notification that says "Wifi network requires sign-in". Clicking on that takes you to non-HTTPS page in a browser that is intended to be intercepted. There is no reason why Apple can't add captive portal detection at OS level like Android does.
- pmontra 10y agoIt doesn't work so well. Sometimes I have to try every single browser on my phone or tablet and different sites. Eventually one of them triggers the captive portal detection. Sometimes I just give up. Any Android from 4 to 7. I guess it depends on how much the portal is trying to be smart.
- keeperofdakeys 10y agoGetting it working correctly can be annoying. There is actually a HTTP status code for captive portal redirection (511), but nothing supports it. So if you use it, captive portal detection stops working.
- akvadrako 10y agoApple already has captive portal detection, but it doesn't redirect to a whole browser - it just displays a mini browser with a Safari WebView.
- asherkin 10y agoAs the OP said, that is already in iOS - it is just that more and more captive portals are whitelisting the domains it hits to check for a captive portal.
- Mayzie 10y ago> captive portals are whitelisting the domains it hits to check for a captive portal. Why?
- 10y ago
- 0x0 10y agoYou would think captive portal vendors will stop doing this sooner than later as more and more web sites and apps use HTTPS only. When most customers fail to connect because HTTPS is everywhere, maybe they will take the hint.