Issue metadata
Sign in to add a comment
|
OriginVerifier doesn't trim trailing slash from domain name
Reported by
markst3v...@gmail.com,
Mar 29 2018
|
||||||||||||||||||||||
Issue descriptionSteps to reproduce the problem: 1. Setup domain with assetlinks.json in /.well-known/ 2. Pass CustomTabsIntent to TrustedWebUtils.launchAsTrustedWebActivity() with URL What is the expected behavior? No address bar displayed What went wrong? Address bar displayed with grey background Did this work before? Yes 65 Chrome version: 67.0.3382.0 Channel: canary OS Version: 8.1 Flash Version: The example in github for svgomg.firebaseapp.com needs a signed apk to go with it for TWA to work: https://github.com/GoogleChrome/custom-tabs-client/tree/master/svgomg. I can't find one in the github repo or Play Store. There is an assetlinks.json file for this domain with two signing key SHA256 hashes.
,
Apr 2 2018
markst3v3ns@ -- Thanks for reporting this issue. Could you please share the sample .APK file to reproduce the issue along with the screen cast for the better understanding of the issue. Also, please share the device details where the issue is reproduced. Thanks!
,
Apr 3 2018
Right, what you describe is the behavior if verification fails, which is roughly speaking falling back to showing the web content in a Chrome Custom Tab.https://developers.google.com/web/updates/2017/10/using-twa#deploy_your_assetlinksjson_to_prove_ownership_of_the_domain describes how to troubleshoot Digital Asset Links.
,
Apr 6 2018
Apk and screenshot attached. The hash in the asset links file: https://my.agcore.co.uk/.well-known/assetlinks.json is from the key used to sign the apk. The app was created with classes from the custom-tabs-client github example slightly modified to only use Chrome Canary. Screenshot taken on Pixel 2 with Android 8.1 and Chrome Canary 67.0.3389.0.
,
Apr 6 2018
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 6 2018
Thanks! It appears that Chrome fetches this URL to verify: https://digitalassetlinks.googleapis.com/v1/assetlinks:check?source.web.site=https%3A%2F%2Fmy.agcore.co.uk%2F&target.androidApp.packageName=com.example.twa&target.androidApp.certificate.sha256Fingerprint=AD%3A8F%3AB5%3A55%3AF2%3A6F%3AB2%3AB7%3AAA%3AF2%3A8F%3A46%3A23%3A3C%3A67%3AFC%3A9A%3ABC%3A7C%3A15%3A22%3AB1%3ABF%3AEB%3A31%3A7F%3A3F%3A12%3ACF%3A8A%3AF7%3A8F&relation=delegate_permission%2Fcommon.handle_all_urls which returns a 400 error. The correct URL doesn't have a slash at the end of the web site to verify (just https://my.agcore.co.uk). +Peter who worked on issue 800422.
,
Apr 6 2018
Good to know what the problem was! So will this be fixed server side at digitalassetlinks.googleapis.com or client side?
,
Apr 6 2018
Client-side in Chrome.
,
Apr 17 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/08bb73244fe60b9f6f1e1e4c636a88931730f918 commit 08bb73244fe60b9f6f1e1e4c636a88931730f918 Author: Peter E Conn <peconn@chromium.org> Date: Tue Apr 17 16:06:28 2018 🤝 Remove trailing slash from Origin. GURLUtils.getOrigin returns an origin formatted with a trailing slash because it calls GURL::GetOrigin which returns a GURL, then serializes this URL. This seems to be incorrect behaviour as more generally an origin is serialized without a trailing slash. GURLUtils.getOrigin is used by AwGeolocationPermissions.java where the returned value is saved to the user's Android Preferences. This means that changing its behaviour would be tricky. For now, I'm updating Origin.java to serialize without a trailing slash and documenting the deviance in behaviour between the two. Bug: 827161 Change-Id: Ia70f8a60263742b28477f969cc075dcb97062f48 Reviewed-on: https://chromium-review.googlesource.com/1013483 Reviewed-by: Matt Menke <mmenke@chromium.org> Reviewed-by: Bernhard Bauer <bauerb@chromium.org> Commit-Queue: Peter Conn <peconn@chromium.org> Cr-Commit-Position: refs/heads/master@{#551351} [modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/chrome/android/java/src/org/chromium/chrome/browser/browserservices/Origin.java [modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/OriginTest.java [modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/net/android/java/src/org/chromium/net/GURLUtils.java
,
Apr 17 2018
markst3v3ns, provided this change doesn't break something and get reverted, this should be available for you to try in Chrome Dev in a few days.
,
Apr 17 2018
Thanks!
,
May 22 2018
I can confirm its fixed in Chrome Canary 68.0.3434.0
,
May 22 2018
Cool, thanks for verifying! |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by pnangunoori@chromium.org
, Apr 2 2018