Skip to content

Port GSA authentication fixes (AltSign PRs #50/#51) to Windows - #51

Closed
shanegillio wants to merge 1 commit into
rileytestut:1.7.4from
shanegillio:gsa-fix
Closed

Port GSA authentication fixes (AltSign PRs #50/#51) to Windows#51
shanegillio wants to merge 1 commit into
rileytestut:1.7.4from
shanegillio:gsa-fix

Conversation

@shanegillio

Copy link
Copy Markdown

This ports the GSA sign-in fixes from rileytestut/AltSign#50 and rileytestut/AltSign#51 to AltServer for Windows. The macOS versions were confirmed working against the recent GSA 503 / error-3840 sign-in failures; the Windows code has the same blind spots, so it presumably fails the same way.

Changes (all in AltSign/AppleAPI+Authentication.cpp)

  • User agent: replaces the 2019-era akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string with AuthKit/1 (Macintosh; OS X 26.5.2) (com.apple.dt.Xcode/26.0), matching AltSign PR Port GSA authentication fixes (AltSign PRs #50/#51) to Windows #51.
  • Retry on 5xx: SendAuthenticationRequest now retries up to 5 times with 1/2/4/8s backoff. Each attempt constructs a fresh http_client — the cpprestsdk equivalent of the ephemeral URLSession in PR Hello, after upgrading to version 26.4 and installing it via a self-signed installer, the app crashes. What could be the reason? #50 — because Apple's GSA edge pins a keep-alive connection to a backend node, and once that node starts 5xx-ing, retries on the same connection never recover.
  • Descriptive errors: when Apple returns a non-plist body (typically an HTML error page), the error now surfaces the HTTP status, Content-Type, and a body snippet via LocalizedAPIError instead of a bare APIErrorCode::InvalidResponse.
  • Trusted-device 2FA: the verify-code response goes through the same validation.

Notes for review

  • Untested on Windows — I don't have a Windows build environment, so this compiles-by-inspection only and needs a build + sign-in test on a real setup. Submitting for review so it can be compiled and tested on the correct platform.
  • Based on the 1.7.4 branch (hence the base). Happy to rebase elsewhere if there's a better target.
  • One consideration: e91915d switched X-Mme-Client-Info to a native Windows AuthKit client ID, while the new User-Agent identifies as Xcode on a Mac. If the patched build still hits 503s, that mismatch is the first thing worth investigating.

🤖 Generated with Claude Code

…stut#51 to Windows

- Use AuthKit/1 user agent instead of 2019-era akd/1.0 CFNetwork string
- Retry GSA requests up to 5 times on HTTP 5xx with 1/2/4/8s backoff,
  using a fresh http_client per attempt to avoid Apple's edge pinning a
  failing backend connection
- Surface HTTP status, Content-Type, and body snippet when Apple returns
  a non-plist response instead of a bare InvalidResponse error
- Route trusted-device 2FA verify response through the same validation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@shanegillio shanegillio closed this Sep 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant