Cannot access authenticated URL for AR in Android, but works in iOS

[aarbro]

Description

I'm trying to use the model-viewer primarily for AR. I supply a URL that requires authentication and it successfully loads it into the viewer presumably because we're still in the context of the browser, but fails on Android when trying to enter AR mode using the intent with the following error:

Couldn't load object

Looks like there's something wrong with this object

The logs show that we don't have the cookie supplied, so 401/unauthorized is returned. Interestingly, it does work in iOS (with an authenticated URL to a usdz file). I'm using the Khronos sample "box.glb", so I'm confident that the actual file is fine (it works when linking directly to the sample).

Also, I have confirmed that using the unstable-webxr attribute allows it work (in Chrome beta with various AR flags turned on). Again, presumably because we stay in the browser.

Is there any way that the browser context can be maintained on Android as is is in iOS? Is there some way to specify headers other than query parameters?

I read over #950, which has some similar discussion, but no real solution there either.

Live Demo

Sorry, no demo available.

Browser Affected

• Chrome
• Edge
• Firefox
• Helios
• IE
• Safari

OS

• Android
• iOS
• Linux
• MacOS
• Windows

Android 10 (QQ1A.2001005.003) on Pixel 3; Play Services for AR 1.14.191118106

Versions

• model-viewer: v0.8.1

[elalish]

@tpsiaki This appears to be a SceneViewer issue; can you give any pointers?

[cdata]

@aarbro this is an interesting issue. Can you share more details about your authentication scheme?

[tpsiaki]

Currently Scene Viewer doesn't share the same http session (and cookies) with the browser from which the intent is launched, so depending on cookie availability for authentication won't work. Scene Viewer needs to be launched with an https URL that can be downloaded from a clean http session. It would be helpful to understand your authentication scheme so we can investigate ways we might be able to support your needs in Scene Viewer.

[cdata]

This is kind of fascinating. I wonder if Safari downloads the .usdz file first and then launches Quick Look with a pointer to the local filesystem.

[aarbro]

@cdata I bet you're right about Safari downloading first. @tpsiaki Is there some reason that Scene Viewer can't be implemented similarly?

[johnwebbcole]

Were using an OAuth2 authorization code grant system with an "http only", "secure" cookie to store the session id.