HTTP action problem

[richardfillan]

Hi,

First, thanks for making and maintaining such a fantastic resource. I work in Assistive Technology and Asterics Grid will be very useful for my clients.

I'm trying to use an HTTP action in a cell to communicate with a local network device to assist in controlling a client's environment. I can run the HTTP GET command ( http://192.168.0.200:5000/localapi) in a browser (Safari or Chrome) no problem, but when I try the same from within Asterics Grid HTTP action in either browser I get an error 'HTTP action Failed! Reason: TypeError :Load Failed'

I think this is to do with security settings in the browser as, if I alter site settings for grid.asterics.eu/xxxxxxxx in Chrome to allow 'insecure content', the HTTP action will work from within the grid cell.

Apart from this not feeling like a great solution, the problem I have is that I don't seem to be able to alter the site settings in Chrome on an iPad, which is where I need to use the Grid.

Does anyone have any ideas how I can solve this?

thanks for reading
Richard

[deinhofer]

Hi,
Unfortunately, there is no easy answer to this, as http requests to other origins then the one calling are not allowed by default for security reasons. This is a feature of the browsers to prevent unintended access to other sites just by opening a specific web page.

When AsTeRICS Grid wants to send an http request to a program running on the localhost (the same machine as the one running the grid.asterics.eu application) then this is no problem.

For all other IP addresses within your local network (e.g. the IP address of your Smart TV) this is only possible if the https server on the device was implemented to allow such a request. (The http server must send a response with a header 'Access-Control-Allow-Origin').

If it does so, it should be possible to do the HTTP action without a problem. If the request is done to a URL without SSL encryption e.g. http (not https) from within https://grid.asterics.eu, then we are talking about a mixed-content access, which is also not allowed by default. Then you have to allow mixed content for this requested URL, see the manual to allow mixed content.

Unfortunately, it really seems that on an iPad you cannot allow the mixed content.

Solutions

Solution 1: Other platform

Use another platform like

• a laptop with Windows/Linux or a MacBook or
• an Android tablet or
• a Windows tablet.

Solution 2: CORS proxy server

If you cannot switch the platform AsTeRICS Grid is running on, you could run a CORS server.
You can run the server locally on your device, or on a device within your home network (e.g. on a Raspberry Pi).
e.g. use cors-anywhere, clone the repository and run it with nodejs.

Then it would be possible to use a special URL that redirects your request to the target device you want to remote control, e.g. http://localhost:8080/http://192.168.209.251/relay/0?turn=toggle

In AsTeRICS Grid you would then simply use that URL in the HTTP action e.g.

On an iPad, you could also try to run that nodejs program within the app Nodejs Lab. But I have never tried it.

Before you run the program, ensure to open the file server.js and exchange the following line

  var cors_api_url = 'https://cors-anywhere.herokuapp.com/';

to

  var cors_api_url = 'http://localhost:8080/';

Maybe there is also a CORS proxy app for iPad, but I could not find one.

But if you are not a developer, I would suggest Solution 1.

[richardfillan]

Thanks for looking into this, and for the detailed explanations. At least I can now understand why I can't get it to work, and the possible solutions.
Sadly, the #unsafely-treat-insecure-origin-as-secure flag is not available in Chrome on IOS.
If I find any other solution I will post here
Thanks again

[deinhofer]

Ok, thanks, that's really a pity!!

Have you also tried this? https://presentations.akamaized.net/Help/VTS/ShowMe/ProblemsBeforeLogin/ShowMeSafariMixedContent.htm

Otherwise, you could also try other browsers like Firefox, or Opera on iPad.

Or have a look at the system settings of ios. Maybe it's an iOS global setting:
https://discussions.apple.com/thread/254193733?sortBy=best

[richardfillan]

Thanks for the suggestions... Unfortunately it seems as though all the possible options for allowing insecure or mixed content on all the browsers I've tried in IOS have been removed, so I'm no further forward.

One thing that puzzles me... if I change the action in Asterics Grid to 'open web page in new tab' and enter the same local IP address I've been trying to use in the 'HTTP action' to access other devices on my local network, it works! (I only need a GET request).
Unfortunately, it also opens a new browser tab (as it suggests it will), which isn't what I need. I can get the tab to close almost immediately, but it takes the grid out of full screen mode whilst doing it.
Any thoughts on why the 'open web page' doesn't have the same security issues as 'HTTP action'?
Thanks again for your thoughts.

[klues]

Hello,

One thing that puzzles me... if I change the action in Asterics Grid to 'open web page in new tab' and enter the same local IP address I've been trying to use in the 'HTTP action' to access other devices on my local network, it works! (I only need a GET request).

The reason is, that it opens a new browser tab and opens the URL just like a user that would insert the URL in a separate tab. It's not some javascript that's doing the request in the background, so no security policies apply. For the background javascript the security measures are preventing "mixed content", so HTTP and HTTPS content on the same page.

I think I've found a possible solution:
I've hosted the same AsTeRICS Grid on another, non-https domain: http://grid.asterics-foundation.org/ - it's exactly the same app as on "grid.asterics.eu", but not served via https. So if you define a http-action to some http endpoint, it's not mixed content anymore and the browser should allow it - at least on my iPad it works with Safari.

Some limitations:

• it's on a separate domain, so you have to re-import user data or re-login your users.
• for some browsers a non-secure page (http) is the reason, that access to local network (e.g. localhost, any local IP) is denied - e.g. Chrome on Desktop. So what seems to solve the issue for some browsers, introduces it on other browsers...

Alternative solution:
Provide your local resource via https using a self-signed certificate (or many services automatically provide HTTPS ports by default), navigate to the resource and add it as security exception in your browser. Then it should work to access the resource from the grid.asterics.eu version of the app.

[richardfillan]

Fantastic! Thanks so much for that, it works perfectly now. I've tested in Safari and Chrome on an iPad and have no errors.

Will the http version of Asterics Grid remain available long term?

Alternatively (or as well as), does this mean I could download and install Asterics Grid on a local machine or server (such as a Raspberry Pi) and serve it via HTTP with the same effect?

Thanks again for taking the time to look into this.

[klues]

Great, glad to hear that it works for you :)

Will the http version of Asterics Grid remain available long term?

Yes, I think so. I've configured our server which is also used for authentication for online users as a proxy. So the content you get from http://grid.asterics-foundation.org/ is actually coming from https://grid.asterics.eu/ - which means that you'll also get all updates at the http-version.

Alternatively (or as well as), does this mean I could download and install Asterics Grid on a local machine or server (such as a Raspberry Pi) and serve it via HTTP with the same effect?

Yes, you can also do that. Just follow the steps for running it locally from the Readme. You don't have to use npm, you could also just serve the content of the repository via any webserver (e.g. apache, nginx). Use the branch stable for the latest released version, master for the latest development version (maybe unstable).

Thanks again for taking the time to look into this.

You're welcome! :)