[Android] Remote Access: Allow bypassing HTTPS and WebSocket auth checks in debug builds

[Nicolas Pomepuy]

vlc-android | branch: master | Nicolas Pomepuy <nicolas at videolabs.io> | Wed Oct 21 07:24:07 2026 +0200| [303d368279e720d437f715aea48f50132bef28a9] | committer: Nicolas Pomepuy

Remote Access: Allow bypassing HTTPS and WebSocket auth checks in debug builds

> https://code.videolan.org/videolan/vlc-android/commit/303d368279e720d437f715aea48f50132bef28a9
---

 .../videolan/vlc/remoteaccessserver/routing/RemoteAccessRouting.kt    | 2 +-
 .../vlc/remoteaccessserver/routing/RemoteAccessRoutingAuth.kt         | 4 ++--
 .../vlc/remoteaccessserver/routing/RemoteAccessRoutingCommon.kt       | 2 +-
 .../vlc/remoteaccessserver/websockets/RemoteAccessWebSockets.kt       | 1 +
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRouting.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRouting.kt
index 15ca0e3449..b8492d44d7 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRouting.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRouting.kt
@@ -54,7 +54,7 @@ fun Route.setupRouting(appContext: Context, scope: CoroutineScope) {
     authenticate("user_session", optional = RemoteAccessServer.byPassAuth) {
         intercept(ApplicationCallPipeline.Call) {
             val server = RemoteAccessServer.getInstance(appContext)
-            if (!server.isHttpsPort(call.request.local.serverPort)) {
+            if (!RemoteAccessServer.byPassAuth && !server.isHttpsPort(call.request.local.serverPort)) {
                 call.respond(HttpStatusCode.Forbidden)
                 finish()
             }
diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingAuth.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingAuth.kt
index a5f77b6267..6da2f1bc88 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingAuth.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingAuth.kt
@@ -51,7 +51,7 @@ fun Route.publicAuthRouting(appContext: Context, scope: CoroutineScope, settings
     //the client is requesting a new code.
     // if the formparameters "challenge" is sent. Remove the corresponding code
     post("/code") {
-        if (!RemoteAccessServer.getInstance(appContext).isHttpsPort(call.request.local.serverPort)) {
+        if (!RemoteAccessServer.byPassAuth && !RemoteAccessServer.getInstance(appContext).isHttpsPort(call.request.local.serverPort)) {
             call.respond(HttpStatusCode.Forbidden)
             return at post
         }
@@ -72,7 +72,7 @@ fun Route.publicAuthRouting(appContext: Context, scope: CoroutineScope, settings
     }
     //Verify the code and inject the cookie if valid
     post("/verify-code") {
-        if (!RemoteAccessServer.getInstance(appContext).isHttpsPort(call.request.local.serverPort)) {
+        if (!RemoteAccessServer.byPassAuth && !RemoteAccessServer.getInstance(appContext).isHttpsPort(call.request.local.serverPort)) {
             call.respond(HttpStatusCode.Forbidden)
             return at post
         }
diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingCommon.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingCommon.kt
index 278fc9f02f..0fb5de6dd8 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingCommon.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/routing/RemoteAccessRoutingCommon.kt
@@ -65,7 +65,7 @@ fun Route.publicCommonRouting(appContext: Context) {
     // Main end point redirect to index.html
     get("/") {
         val isHttps = RemoteAccessServer.getInstance(appContext).isHttpsPort(call.request.local.serverPort)
-        if (isHttps) {
+        if (isHttps || RemoteAccessServer.byPassAuth) {
             call.respondRedirect("index.html", permanent = true)
         } else {
             call.respondRedirect("/index.html#/ssl", permanent = false)
diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/websockets/RemoteAccessWebSockets.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/websockets/RemoteAccessWebSockets.kt
index 19dd684b30..f9014bd2f2 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/websockets/RemoteAccessWebSockets.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/websockets/RemoteAccessWebSockets.kt
@@ -276,6 +276,7 @@ object RemoteAccessWebSockets {
      * @return true if the websocket message is allowed
      */
     private fun verifyWebsocketAuth(incomingMessage: WSIncomingMessage?): Boolean {
+        if (RemoteAccessServer.byPassAuth) return true
         synchronized(tickets) {
             tickets.removeIf { it.expiration < System.currentTimeMillis() }
             return incomingMessage?.authTicket != null && tickets.firstOrNull { incomingMessage.authTicket == it.id } != null