Outlook web add-in for iOS not persisting 3rd party cookies - works in Safari - outlook-web-addins

I am developing an app for our company; because of legacy reasons when the user logs in we use a
third party JSESSIONID cookie.
Issue
What I am seeing is that the cookie when sent to the client is not saved, and therefore not sent on subsequent requests to the server. As such, the server does not think the user is logged in.
Normally I would attribute this to the blocking of 3rd party cookies feature of WebKit/View, but I have turned this off in the Safari settings.
As an FYI we have an Ionic/Cordova project that is based on the same code and it works fine in iOS.
If I use the Add-in on MacOS (Native Outlook and Outlook Web) it works fine.
Works fine in Chrome/Firefox as well.
Works in Android on Outlook for Android app
Our server sets all the correct CORS headers as well.
Since the add-in is just a webapp, I can launch it directly in Safari on iOS, and login there; this also works.
I am aware that Apple regressed WebKit in version 12 (CORS related), but they fixed it in the latest version of iOS 13/MacOS. However, Outlook for iOS (WebView) does not appear to be saving cookies. I can see that looking at the requests coming to the server, they are missing the SessionID which was sent to the client.
I can also see it from the requests when I run through a proxy (Charles) that the Cookie header is not set.
It is also almost impossible to debug the WebView in Outlook for iOS (the webview does not show up in the Safari Developer menu on my Mac). I am easily able to debug other WebViews such as the mobile project mentioned above.
Question
Is the Webview configured to prevent 3rd party cookies explicitly? if yes, can it be turned off somehow? I have turned off the 3rd party tracking in Safari, but that does not appear to help.
I have been reluctant to use the DialogJS API since the login flow is working on my Mac; and this would considerable change our UX for login. Also, I have not seen any examples of using this API for a mobile project. Can it be used with a mobile project, and if so what would it look like?
All the examples relate to the desktop only.

Related

Alerts not displaying in IE 11 using prod profile on JHipster 4.14.2

We've just moved our first small JHipster app into production, very exciting and thank you once again for such an awesome project tool.
One small thing we have noticed though, on IE 11, (which is the only approved browser my client currently uses in the company), the alert messages no longer appear. Firefox and Chrome works perfect though.
Could this please be verified? I suspect an additional polyfill maybe needed.
I get no errors in IE developer tools console.
Update:
Alerts work in IE11 using the dev profile but not in prod profile.
This is what is displayed in dev profile IE11.
This is what is displayed in the prod profile IE11.

How to build web application that run in WeChat in app browsers?

I am trying to build a simple web application, which capture users photo and sent it my custom server there by connected to some other business use-case. My web page uses HTML's file input control to launch native camera or gallery pick up option.
var input = document.createElement('input');
input.setAttribute('accept', 'image/*');
input.setAttribute('capture', 'camera');
input.setAttribute('type', 'file');
input.click();
This web app, I placed in local webserver with a name "PhotoLocker" and testing with url like
https://localhost(ipaddress to access via mobile browser)/PhotoLocker/index.html
This link is working fine both on desktop and mobile chrome browsers and am able to debug any issues. Where as same link, I try to access from WeChat browser (just opening above link from chat window), it is not at all opening my application in WeChat in app browser.
After googling, I found that https URL scheme is not supported by WeChat. is it True? When I paste the same app url as weixin://ipaddress/PhotoLocker/index.html, I am able to see my web app home page but it is not working as expected.
My Question is - how to debug my webpage opened in WeChat browser? Do I need a official WeChat Dev account even to develop and test sample apps?
Additional Info :
I am able to debug webpage from WeChat web devloper tool as mentioned in below link. But, unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1
I am a frontend developer in China, Chinese. Forgive my English for any mistake, misunderstanding I could make. Some links (dev docs mostly) below contain sites complete in Chinese, because I can not find corresponding English ones for now.
how to debug my webpage opened in WeChat browser?
Tencent provide an IDE for developing regular web interface and WeChat-mini-program, with which developer can directly interact with:
JSSDK (basically a special weixin
Object lives only in in-WeChat-browser);
API provided in WeChat-mini-program.
If you download that IDE:
First it will ask you is to use you WeChat to scan the QRCode, then confirm login with your WeChat account;
Next it will show up two square button (image below), left one is for WeChat-mini-program, the right one is for you to testing regular web page.
Click the right blue one, then you can find your way out, it's just something built top on project Blink.
As you can see the part of debugging regular webpage in WeChat IDE is no more than a simulator (in the WeChat-mini-program part, developer can write code directly in it), and in my experience it does have bugs, you will still need to test code in real machine.
For that Tencent provide another tool called vConsole, tutorials here, with it you can do following things directly in in-WeChat-browsers:
View console logs;
View network requests;
View document elements;
View Cookies and localStorages;
Execute JS command manually
and so on
Do I need a official WeChat Dev account even to develop and test sample apps?
Depends.
You may know the Official Account inside WeChat, with webpages directly opened in any context inside in-WeChat-browser, it will have the ability to interact the weixin Object, or have some API like login with WeChat, pay with WeChat Pay:
API like close current in-WeChat-browser, hide-share-button will not required anything special, you don't need to register any Official Account;
But if you want yo do the Pay, Login thing, you need an Official Account and pay for the ability every year (not sure about this outside China).
The localhost problem you faced
I don't have my working machine with me now so I can not test. Regularly I can proxy localhost with Charles then debugging in WeChat, but never do the https, I will try it later.
All the information got regarding how to debug webpage opened in wechat browser redirects to how to see log or ajax/netwrok calls analysis.
Even with WeChat web devloper tool as mentioned in below link, I am unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1.
Hence further analyzed remote mobile webpage debugging and found that there is no way to put break points, watch, expressions and all just like in chrome dev tools is not possible.
As a work around - you are able to debug code, when you simulate page in dev tools but no way to debug webpage in mobile device.
Same webpage when tried to do remote debugging as per WeChat web devloper tool documentation. here we can only see console logs and network calls.

Chrome extension accessing UWP app?

We have chrome and FF extensions which works with a native messaging app. Recently we developed edge extension and a UWP app which works in the same way. Now the user has to install two separate native messaging apps if they want use any chrome/FF/Edge browsers.
My question is, is it possible for Chrome/FF extension talk to windows UWP app?
Unfortunately no. On Windows, both Chrome and Firefox use the registry to locate the native applications manifest, and Windows Store apps are forbidden from writing to the registry. (ref: Prepare to package an app (Desktop Bridge)
If something changes (Store apps gain the ability to alter the registry, or Chrome and Firefox introduce an alternative way to locate the manifest), then it might be possible. Though likely not via the UWP app directly. UWP apps appear to support standard input and output, but the way they are run prevents access to it. It might however be possible to create an intermediary Win32 app that can communicate with the UWP app via the AppService and the browser extension via stdio.
Afterthought: Enpass Password Manager (win32) was ported to the Windows Store reportedly because of API issues, and has a browser extension for Chrome and Firefox. Might be worth asking them how they pulled it off. I did some more digging, and figured it out. localhost loopback, a custom url scheme, web sockets, and browser verifications is how they are doing it. Not an ideal solution, but it seems to work.

android webview autocomplete/autofill

I am creating a web app which requires a login. It seems my webview autofill/autocomplete does not work. Is this feature disabled by default? In my search through the web I have found many posts asking how to disable this feature, leading me to believe that it is enabled by default. My credentials are remembered and autofilled fine when testing my web app in chrome for android. I have also loaded gmail in my webview and tested to see if autofill worked, and I still could not get it to work. My app is set for SDK 18 and up.
Thanks

Safari problems accessing Windows Integrated Authentication (aka NTLM) protected web site

Our web application uses Windows Integrated Authentication (aka NTLM Auth) for security.
It's working fine for both IE and Firefox users, but Safari users are seeing intermittent problems. Browsing the site will work fine, but every once in a while there will be problems loading elements of a page (e.g. CSS or JS files). Reload and the problem will go away.
If we use a debugging proxy (Fiddler) we can see that there is a lot of extra 401 requests happening with Safari. Every once in a while a request for a resource will get stuck in a 401 request loop, and eventually fail.
I can't see anything that we're doing to cause this, and it would appear that it's a bug in Safari. Has anyone ran across this issue before, and have any suggestions for a resolution?
Thanks,
Darren.
Some web sites http://www.musteat.org/nodes/show/151 indicate this is an issue with negotiated authentication.
You can turn off Negotiate in favor of pure NTLM in IIS via the NTAuthenticationProviders Metabase setting, and the following ADSUTIL command.
cscript adsutil.vbs set w3svc/WebSite/<SiteID>/NTAuthenticationProviders "NTLM"
Change < SiteID > to the appropriate ID, typically 1.

Resources