4

I created a router that connects to facebook to get some info before a user may access the internet.

First they connect, get the Captive Portal Page and then continue to a facebook login. Since the upgrade to iOS7 it fails to load the facebook login page. On my mac with the Captive Portal Assistant it has no problems and even on the phone itself while using the iOS version of safari there are no problems.

What is going wrong here? Is facebook filtering request from the iOS7 Captive Portal Assistant or is Apple doing some sneaky stuff here?

It seems the problem is widespread and only related to facebook.

Update: I worked with the beta's and they worked fine a few weeks ago. Now with the same beta version it doesn't anymore. So another point for the facebook explaination.

Regards, Cas

Cas Wolters
  • 371
  • 3
  • 11

3 Answers3

5

This problem was fixed by Apple since IOS 8. But as all iPhone 4 users can't upgrade to IOS 8 this problem is still one.

The IOS 7 devices check for the following domains:

www.appleiphonecell.com
captive.apple.com
captive.apple.com
www.apple.com
www.itools.info
www.ibook.info
www.airport.us
www.thinkdifferent.us

Whitelisting this domains stops the login mask to be appearing as the IOS device thinks, that the internet is working as expected. This way you have control on the things which happens, as the IOS device does not interrupts anything, if you use a normal browser for login.

If you don't whitelist the domains, the following thing happens. I debugged it on routers with several IOS devices and they all did mostly the same:

  1. If you connect to a wifi, the IOS device tries to connect to one of the domains, which are listed above. If it can contact one of the domains, it tries another one. If it can't, it starts the redirect, which is controlled by the router. Sometimes it query one or more domains, before it thinks, that the internet is working.
  2. After the check, the login screen redirects to your router and then to the login screen of your captive portal. This behavior stayed the same as it was on IOS 6 or before.
  3. Now you start an oauth login to a 3rd party provider like Facebook, Google or Twitter. And now the difference appears. You can check it on a router, if you run it in debug mode. As the IOS device goes to an other domain for oauth login (like www.facebook.com) the iPhone thinks, that something changed and starts to query one of the apple domains, which are listed above. The user sees only a white screen and in the background the IOS device tries to contact one of the domains repeatedly. For the user this seems to be an error, as the screen stays white or takes very long to show the login on the 3rd party provider. Sometimes it stops loading and nothing happens forever.

To avoid this behavior, you must whitelist the above listed domains. This is a not a common behavior for IOS users, but this way, your browser have the control of the login session and the IOS device don't interrupt it as it does with the login screen.

Some shallow parts of information is reported on the following sites:

I couldn't find a detailed description of the problem and found the one above myself by debugging all parts with some routers and IOS devices like iPhones and iPads.

Fa11enAngel
  • 4,690
  • 2
  • 39
  • 38
  • This just avoids the dialog from appearing. We want the dialog to appear, it does, but a redirect to facebook does not seem to work. – Cas Wolters Oct 11 '13 at 11:59
  • I know. Have you tried to debug it on router? I did it and I checked the behavior on the router and could understand what it does. I'll add it to the answer, as this is too long for the comment. – Fa11enAngel Oct 11 '13 at 20:47
  • The problem is gone on IOS 8, but iPhone 4 can't be updated to IOS 8, so the problem is still one. – Fa11enAngel Dec 16 '14 at 16:16
0

I've just tested various router settings and noticed that iOS 7 is NOT trying to contact above mentioned sites/URLs when router's DOMAIN field is blank.

My guess is that blank domain points to a consumer-type network set up and Apple is not expecting a Captive Portal at such network. If you have access to administer your router see if you can clear out the DOMAIN field (and restart/retest).

AnalogThinker
  • 31
  • 5
0

I found my solution to my problem. (a while ago, but I found this post again)

First I found out, iOS makes 3 calls, first to check, second to get the page that needs to be displayed, third to check again after the pageload. Then I discovered, for every POST or GET action made by the page, regarding of the source page was refreshed, iOS checks for an active internet connection. Since the facebook api makes a lot of calls, the browser starts stalling(possible in combination with QoS on my router) and freezes the page.

My Solution:

Since I am in control of the DNS records of the Router I use, I redirected all domains towards my own server.

First I saved the check request, this to later identify the user when he comes back for the 3th request.

When the second request comes I just display an info window that every thing is right, and the user has to click the "Done" button.

The page is loaded, so iOS checks again, but i recognize the user so I display the OK-code Apple also displays. The "Done" button us show, and the user has "internet", according to iOS..

On the page that I display, I instruct the user to open the webbrowser. When he does, he opens a page and my portal with the right page is shown(I can detect this based on the Browser Agent). Then my facebook api start doing its job, and of we go :-)

Let me know if someone needs some more info on how to detect or maybe even a code sample if necessary.

Extra Information To capture a user on your own server, redirect every request to your processing page using for example .htaccess. The request is made to a domain with a subfile e.g: http://captive.apple.com/getrT09Nx7G/YNrnUOulnDj/3cfrq3M40iR.html

To keep multiple users apart, use the unique url the device tries to contact when checking for internet, in this case: /getYT09Nx7G/YN1nUOulnDj/3cfMq3M40iR.html

Cas Wolters
  • 371
  • 3
  • 11
  • "On the page that I display, I instruct the user to open the webbrowser." How do you instruct the user to do so? Do you know a way to make the user switch to Safari iOS? by clicking on a link for instance. – Loris Guignard Apr 09 '15 at 18:42
  • By adding a link with the right target attribute, it wil open Safari(target="_blank") – Cas Wolters Apr 10 '15 at 09:18
  • Unfortunately, I tried that and can’t make it work, at least on iOS 8.3. My PoC is quite simple: My wifi access point has an iptable rule to proxy tcp trafic to a nodejs script. That script let every requests go through normally, except the ones were the user-agent is starting with "CaptiveNetworkSupport". In that case, I modify the response to return a simple web page with a target=_blank link. Clicking on this link redirect the user to the said page but stay in the Captive portal and do not open Safari. – Loris Guignard Apr 10 '15 at 09:49
  • Strange, I use target="_blank", how about target="_top" ? – Cas Wolters Apr 11 '15 at 15:40