Support webcal http auth & store credentials

@georgehrke

Ideally :

Have a checkbox "Provide credentials" beneath the url input field
Show login and password beneath when it's checked
Save credentials in the app. Secured enough ?
Perform the proxy request and provide these credentials in the headers

What do you think ? @georgehrke @raghunayyar

@LukasReschke

Regarding security/storing of credentials @LukasReschke should have look too I guess.

Well, you can already store credentials by putting them in the url with user:password@url,
The problem is, that a user with whom the calendar is shared is will see the credentials.
But as the webcal is fetched by the browser, you would not be able to share password protected webcal calendars (without sharing the auth as well)

I wonder if webcal calendars should be shared anyway, since you can just give the link to other people.

Sharing it is still way easier than telling someone to copy and paste that url into the new subscription field.

Well, you can already store credentials by putting them in the url with user:password@url

Right now ? Doesn't work for me, maybe because it seems http:// gets added on front.

I have also a problem, that I have to put ht eusername and password in the URL.
...and I have a non standard.port for my cloud.

This result in a URL für webdav:
webdav://username:password/example.to:1234/cloud/remote.php/dav/calendar.ics

Outlook can't get the calendar. Error:
"Der Internetkalender kann in Outlook nicht überprüft oder hinzugefügt werden. Setellen sie sicher, dass der Hyperlink ein gültiger Kalenderhyperlink ist.

Any suggestions? Or is this not supported (credentials + special port)

It's supposed to be user:pass@host:port/path

It doesn't work if I add https:// on front. Is only HTTP supported?

I would like to subscribe to another Nextcloud calendar so I tried to subscribe with the following URL:

http://USERNAME:PASSWORD@HOST/remote.php/dav/calendars/USERNAME/CALENDARNAME?export

The first request works without any problems but any further requests are sent without a password. When I check the WebCal-Address it looks like this:

http://USERNAME@HOST/remote.php/dav/calendars/USERNAME/CALENDARNAME?export

Is there any security mechanisms which prevent that the password is remaining in the URL?

@wuethrich44 Not that I know of, but you should publish the calendar on the other end and then subscribe to it's public url.

@tcitworld

@tcitworld Ok that could be an approach but I don't have admin rights in the other server so I can't make the calendar public.

You don't need admin rights, just regular user access that you seem to have.

Is it safe to expose a password like this??

Well… it's stored next to the URL in the DB or wherever it is shown (AFAIK when hovering over the calendar in the app you can also see the URL or so). As such, that needs to be taken into account. The (calendar) devs or so may also not be aware that there can be sensitive information embedded.
Other than that, it's not more or less safe than a separate input for username and password. Remember HTTPS URLs are encrypted. Having that URL in your browser history would potentially be worse in most threat models… 🙃

@tcitworld

@tcitworld HTTP Authentication does not seem to work reliably - I cannot add a calendar subscription in Nextcloud with such a link (which perfectly works in Google Chrome to download the ics files).

https://u.ser%40hadomain.de:smallBig%3B2@mail.hadomain.de/SOGo/dav/u.ser@hadomain.de/Calendar/personal.ics

I get Authentication failed in Nextcloud log, as it seems not to store the credentials properly. (FYI the URLs was anonymised)

Subscribing to https://myuser:mypass@example.com/some/webcal.ics for me results in

{"reqId":"q8VoNa4IIlJhW3a4ZI24","level":2,"time":"2023-01-12T11:33:03+01:00","remoteAddr":"","user":"--","app":"dav","method":"","url":"--","message":"Subscription 52 could not be refreshed due to a network error","userAgent":"--","version":"25.0.2.3","exception":{"Exception":"GuzzleHttp\\Exception\\ClientException","Message":"Client error: `GET https://example.com/some/webcal.ics` resulted in a `401 Unauthorized` response","Code":401,"Trace":[{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":69,"function":"create","class":"GuzzleHttp\\Exception\\RequestException","type":"::","args":[{"__class__":"GuzzleHttp\\Psr7\\Request"},"*** sensitive parameters replaced ***",null,[],null]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":204,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":153,"function":"callHandler","class":"GuzzleHttp\\Promise\\Promise","type":"::","args":[1,"*** sensitive parameters replaced ***",null]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/TaskQueue.php","line":48,"function":"GuzzleHttp\\Promise\\{closure}","class":"GuzzleHttp\\Promise\\Promise","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":248,"function":"run","class":"GuzzleHttp\\Promise\\TaskQueue","type":"->","args":[true]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":224,"function":"invokeWaitFn","class":"GuzzleHttp\\Promise\\Promise","type":"->","args":[]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":269,"function":"waitIfPending","class":"GuzzleHttp\\Promise\\Promise","type":"->","args":[]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":226,"function":"invokeWaitList","class":"GuzzleHttp\\Promise\\Promise","type":"->","args":[]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/promises/src/Promise.php","line":62,"function":"waitIfPending","class":"GuzzleHttp\\Promise\\Promise","type":"->","args":[]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":187,"function":"wait","class":"GuzzleHttp\\Promise\\Promise","type":"->","args":[]},{"file":"/var/www/nextcloud/lib/private/Http/Client/Client.php","line":218,"function":"request","class":"GuzzleHttp\\Client","type":"->","args":["get","https://example.com/some/webcal.ics",["/home/data/nextcloud/files_external/rootcerts.crt",30,[10],{"__class__":"GuzzleHttp\\HandlerStack"},[false],"And 3 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/nextcloud/apps/dav/lib/CalDAV/WebcalCaching/RefreshWebcalService.php","line":217,"function":"get","class":"OC\\Http\\Client\\Client","type":"->","args":["https://example.com/some/webcal.ics",[[10],{"__class__":"GuzzleHttp\\HandlerStack"},[false],["myuser","mypass"]]]},{"file":"/var/www/nextcloud/apps/dav/lib/CalDAV/WebcalCaching/RefreshWebcalService.php","line":89,"function":"queryWebcalFeed","class":"OCA\\DAV\\CalDAV\\WebcalCaching\\RefreshWebcalService","type":"->","args":[[52,"examplecom-1","principals/users/myuser","https://myser:mypass@example.com/some/webcal.ics",1673519570,"And 9 more entries, set log level to debug to see all entries"],[]]},{"file":"/var/www/nextcloud/apps/dav/lib/BackgroundJob/RefreshWebcalJob.php","line":115,"function":"refreshSubscription","class":"OCA\\DAV\\CalDAV\\WebcalCaching\\RefreshWebcalService","type":"->","args":["principals/users/myuser","examplecom-1"]},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/Job.php","line":78,"function":"run","class":"OCA\\DAV\\BackgroundJob\\RefreshWebcalJob","type":"->","args":[["principals/users/myuser","examplecom-1"]]},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/Job.php","line":64,"function":"start","class":"OCP\\BackgroundJob\\Job","type":"->","args":[{"__class__":"OC\\BackgroundJob\\JobList"}]},{"file":"/var/www/nextcloud/apps/dav/lib/BackgroundJob/RefreshWebcalJob.php","line":108,"function":"execute","class":"OCP\\BackgroundJob\\Job","type":"->","args":[{"__class__":"OC\\BackgroundJob\\JobList"},{"__class__":"OC\\Log"}]},{"file":"/var/www/nextcloud/cron.php","line":152,"function":"execute","class":"OCA\\DAV\\BackgroundJob\\RefreshWebcalJob","type":"->","args":[{"__class__":"OC\\BackgroundJob\\JobList"},{"__class__":"OC\\Log"}]}],"File":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Exception/RequestException.php","Line":113,"message":"Subscription 52 could not be refreshed due to a network error","exception":[],"CustomMessage":"Subscription 52 could not be refreshed due to a network error"},"id":"63bfe1ee9ecca"}

For this, some kind of stock credential manager would be necessary, surely. I realize that this would be a lot to implement, but I'd love to be able to store and manage these credentials from Bitwarden.

Bump. Just tried this with an existing Horde Kronolith installation. For reference: DAVx⁵ works perfectly with this on Android.

User/password auth doesn't exit (or work via URL) in Nextcloud Calendar.

There is the option to add external storage for WebDAV and it works with Horde WebDAV ICS connectors or remote CalDAV ones (connects and shows a green checkmark). Why can't this app make use of the credentials stored there? That'd maybe be a quicker way to implement this. Add a CalDAV URL as external storage including credentials, then add the same URL as external read-only (why read-only btw?) calendar to the Calendar app, without credentials, using the credentials stored in Nextcloud for this URL.

The only option you have to use webcal/ical URLs with Basic Auth, is to include the credentials in the URL.
But attention, the connection class doesn't urldecode user and password. So you have to use a password without special chars like @, /, # etc.

The following patch includes URL decoding for user and pass:

--- apps/dav/lib/CalDAV/WebcalCaching/Connection.php
+++ apps/dav/lib/CalDAV/WebcalCaching/Connection.php
@@ -61,7 +61,11 @@
                $user = parse_url($subscription['source'], PHP_URL_USER);
                $pass = parse_url($subscription['source'], PHP_URL_PASS);
                if ($user !== null && $pass !== null) {
-                       $params[RequestOptions::AUTH] = [$user, $pass];
+                       // parse_url() does not decode percent-encoded characters, so
+                       // special characters (e.g. '#', '@', ':') in the credentials
+                       // must be decoded before use, or Basic Auth sends the raw
+                       // percent-encoded sequence instead of the real password.
+                       $params[RequestOptions::AUTH] = [urldecode($user), urldecode($pass)];
                }

                try {

The credentials are stored in the source column in oc_calendarsubscriptions, so this is still a security gap.

@beedell-roke

@beedell-roke Not yet.

@beedell-roke

@beedell-roke see nextcloud/server/pull/64941

Fix(calendar): nextcloud/calendar/issues/70

Navigation Menu

Repository navigation

Support webcal http auth & store credentials #70

27 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support webcal http auth & store credentials #70

Description

Activity

raimund-schluessler commented on Sep 20, 2016

georgehrke commented on Sep 20, 2016

tcitworld commented on Sep 20, 2016

georgehrke commented on Sep 20, 2016

tcitworld commented on Sep 20, 2016

Tanarri commented on Sep 23, 2016

georgehrke commented on Sep 23, 2016

treiher commented on Dec 16, 2016

fabwu commented on Jan 10, 2017

tcitworld commented on Jan 10, 2017

fabwu commented on Jan 10, 2017

tcitworld commented on Jan 10, 2017

27 remaining items

rugk commented on Feb 19, 2022

mkrecek234 commented on Jun 8, 2022

simonspa commented on Jan 12, 2023

beedell-roke commented on Jul 6, 2023

pannal commented on Oct 6, 2024

theroch commented on Sep 25, 2026

beedell-roke commented on Sep 25, 2026

theroch commented on Sep 25, 2026

beedell-roke commented on Sep 26, 2026

theroch commented on Sep 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions