New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 793626 link

Starred by 4 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression



Sign in to add a comment

"Site cannot be installed: the page is not served from a secure origin" - on HTTPS

Reported by nunomigu...@gmail.com, Dec 9 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Steps to reproduce the problem:
1. Create a Manifest and a Service Worker ready to install as a PWA
2. Have your website under HTTPS
3. "Add to Homescreen" or visit the page twice
(this is on Desktop)

What is the expected behavior?
Your app will be installed.

What went wrong?
"Site cannot be installed: the page is not served from a secure origin"

Did this work before? Yes Last I successfully tested this was in September 24, 2017. I believe I was using a BETA version of Chrome.

Does this work in other browsers? Yes

Chrome version: 63.0.3239.84  Channel: stable
OS Version: 10.0
Flash Version: 

Also reported by another person here -- https://stackoverflow.com/questions/47522793/site-cannot-be-installed-the-page-is-not-served-from-a-secure-origin-yet-page
 
Cc: vamshi.k...@techmahindra.com
Labels: Needs-Triage-M63 Triaged-ET Needs-Feedback
"Thanks for filing the issue!

@Reporter: Could you please provide a sample test file to check the issue as it would be out of scope for ET team to Create a Manifest and a Service Worker."
I reduced my code to a minimum, and I still reproduce the issue.

Here's a sample:




serviceworker.js:

'use strict';

self.addEventListener('install', function(e) {
	self.skipWaiting();
});

self.addEventListener('fetch', function(e) {
});




manifest.json:


{
	"name": "My App",
	"description": "My App is the best.",
	"short_name": "My App",
	"icons": [{
		"src": "https://images.myapp.com/My-App-Logo-64.webp",
		"sizes": "64x64",
		"type": "image/webp"
	}, {
		"src": "https://images.myapp.com/My-App-Logo-64.png",
		"sizes": "64x64",
		"type": "image/png"
	}, {
		"src": "https://images.myapp.com/My-App-Logo-128.png",
		"sizes": "128x128",
		"type": "image/png"
	}, {
		"src": "https://images.myapp.com/My-App-Logo-96.png",
		"sizes": "96x96",
		"type": "image/png"
	}, {
		"src": "https://images.myapp.com/My-App-Logo-144.png",
		"sizes": "144x144",
		"type": "image/png"
	}, {
		"src": "https://images.myapp.com/My-App-Logo-192.png",
		"sizes": "192x192",
		"type": "image/png"
	}]
}




script.js:


navigator.serviceWorker.register("serviceworker.js").then(function() {
	console.log('Service Worker Registered'); // this works well - it registers the service worker
});



index.html:

<link rel="manifest" href="/manifest.json" />
Project Member

Comment 3 by sheriffbot@chromium.org, Dec 11 2017

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "vamshi.kommuri@techmahindra.com" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: krajshree@chromium.org
Labels: Needs-Feedback
nunomiguelperalta@ - Could you please provide sample test file to test the issue from TE-end. As the code in comment #2 is not of much help in triaging the issue from our end.

Thanks...!!
I already provided enough information for you to proceed. This is happening with any minimal setup for PWA.

I have no more test files to provide.
Can you attach a screenshot of the page before attempting to install it? Are there *ANY* non-secure resources on the page? Currently, our logic rejects pages that have any non-secure references.

// static
bool InstallableManager::IsContentSecure(content::WebContents* web_contents) {
  if (!web_contents)
    return false;

  // Whitelist localhost. Check the VisibleURL to match what the
  // SecurityStateTabHelper looks at.
  if (net::IsLocalhost(web_contents->GetVisibleURL().HostNoBracketsPiece()))
    return true;

  security_state::SecurityInfo security_info;
  SecurityStateTabHelper::FromWebContents(web_contents)
      ->GetSecurityInfo(&security_info);
  return security_info.security_level == security_state::SECURE ||
         security_info.security_level == security_state::EV_SECURE;
}

See attached screenshot.

There is absolutely nothing coming from "http".
Apologies. Attached wrong screenshot.
PWA Chrome.jpg
68.4 KB View Download
Re #8: Thanks, that helps narrow things down. Do you see the same issue with Chrome 64 or Chrome 65?
Components: Blink>AppManifest
I've just installed Chrome 64 Dev, and then installed the same extensions I have, and it appears to be working.
I don't know if this means that Chrome 64 is actually fixed, or if it could be some configuration on my Chrome 63 setup...
Ok - I've just tested on Chrome 63 Beta, and it worked.

This then means the problem is in my setup/configuration, which likely means this issue might happen with other users, and probably needs to be fixed on Chromium?
Can you share the exact build number of the working Chrome 63 beta?
63.0.3239.90
This is still happening with 63.0.3239.132 (64-bit)
Project Member

Comment 17 by sheriffbot@chromium.org, Jan 13 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "krajshree@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: NeedsTriageHelp
As per comment#5 reporter says its not possible to provide any other test files, hence requesting some one from dev team to look into this issue. Adding label TE-NeedsTriageHelp for further investigation.

Thanks!
Hello,

I've just realized I had a few flags turned on, and one of them might be the cause for the error I was getting.

Once I disabled them, I could install the app with no problem:

#enable-new-app-menu-icon
#bypass-app-banner-engagement-checks
#enable-experimental-app-banners
#enable-app-banners
#enable-message-center-new-style-notification

You might want to have a look at them, before they go live.

Thank you.
Labels: -NeedsTriageHelp TE-NeedsTriageHelp
Components: -Blink>ServiceWorker
Status: Untriaged (was: Unconfirmed)
NOT_FROM_SECURE_ORIGIN error comes from InstallableManager::CheckEligiblity()
https://cs.chromium.org/chromium/src/chrome/browser/installable/installable_manager.cc?l=431&rcl=c67646fb6096ac1d87b516b2eaf2eb9968d2da73

Removed SW as Blink>AppManifest seems like the right component.

Sign in to add a comment