I have coded a python webserver, to gain access to the control panel you must fill in a token. This token is send to the webserver, the webserver then replies with the control panel.
All works fine, from my computer the token works everytime - HOWEVER, from an iOS device, it does not work 90% of the time > A token is not send most of the time!
HTML:
<!DOCTYPE html>
<html>
<head>
<title>Drakon</title>
<link rel="stylesheet" type="text/css" href="access.css">
</head>
<body>
<div class="login">
<div class="heading">
<h2>Gain access</h2>
<form method="POST">
<div class="input-group input-group-lg">
<span class="input-group-addon"><i class="fa fa-lock"></i></span>
<input name="token" type="password" class="form-control" placeholder="Token">
</div>
<button type="submit" class="float">Validate</button>
</form>
</div>
</div>
</body>
</html>
This is the POST-request I receive from an iOS device:
POST / HTTP/1.1\r\nHost: 192.168.2.4:8000\r\nReferer: http://192.168.2.4:8000/\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: nl-nl\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://192.168.2.4:8000\r\nContent-Length: 10\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53\r\n\r\n
What I should get, and sometimes DO get for some reason:
POST / HTTP/1.1\r\nHost: 192.168.2.4:8000\r\nReferer: http://192.168.2.4:8000/\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: nl-nl\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://192.168.2.4:8000\r\nContent-Length: 11\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53\r\n\r\ntoken=lucas
The difference: at the correct one (2nd one) there is a token=lucas at the end. How come the iOS device sometimes does not send this token along with the post request? Am I overseeing something?
In the bad scenario, all fails; the device is not even redirected to the homepage again, like it should do after an incorrect token.
The request is sent from safari browser on iOS device and not the iOS custom app.