okhttp user agent is blocked in potential bot crawling lists

[tuxedo-stefan]

Problem scope

• I'm sure that this is a DAVx⁵ problem.

App version

• I'm using the latest available DAVx⁵ version.

Android version and device/firmware type

No response

Steps to reproduce

1. Run a Nextcloud behind an OPNsense Firewall with Nginx Reverse Proxy Plugin
2. Try to access the Nextcloud with DAVx5 Android App (e.g. add new account)

Problem shouldn't be limited to Nextcloud and also shouldn't be limited to OPNsense

Actual result

DAVx5 gets the response: 403

Nginx in OPNsense bans the request because by default it bans every request with user agent containing "okhttp". This is because it assumes that only bots use "okhttp" as user agent:

/var/log/nginx/perm_ban.access.log 
"https://nc.domain.com/index.php/login/v2" 403 44 "-" "DAVx5/4.5.9-ose (dav4jvm; okhttp/5.3.2) Android/15" "-"

Expected result

The user agent of DAVx5 should not include "okhttp".

Then the request would pass the Nginx proxy successfully.

The same problem was fixed in the Home Assistant App. Seems like they modified their user agent string to avoid getting banned by OPNsense (or other services that include some lists of known bots and crawlers). You can find everything related to this topic in their Issue: home-assistant/android#1364

Further info

A temporary workaround is to remove "okhttp" from the OPnsense Nginx (--> Nginx --> Configuration --> General Settings --> Global HTTP Settings --> Bots User Agents)

But then you have also allowed all bots with okhttp in their user agent.

[rfc2822]

Why is it a DAVx5 bug if someone is blocking its user agent?

However I wanted to rewrite the User-Agent anyway (and possibly remove okhttp). However I'm sure that this will break a lot of existing access rules.

[tuxedo-stefan]

Its not a bug but it could be a great improvement, if many DAVx5 connections would work just out of the box. Especially for some secure/professional setups, where it is common to have some auto-bans of bots/crawlers.

These lists of known bots user agents are used in many places I assume. At least in OPNsense and Bunkerweb.

When you are rewriting the user agent anyway, then it would at least solve the problem for those security solutions.

Thanks for considering it.

[rfc2822]

Tracked in #1996