New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 827161 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug-Regression

Blocking:
issue 800418



Sign in to add a comment

OriginVerifier doesn't trim trailing slash from domain name

Reported by markst3v...@gmail.com, Mar 29 2018

Issue description

Steps to reproduce the problem:
1. Setup domain with assetlinks.json in /.well-known/
2. Pass CustomTabsIntent to TrustedWebUtils.launchAsTrustedWebActivity() with URL

What is the expected behavior?
No address bar displayed

What went wrong?
Address bar displayed with grey background

Did this work before? Yes 65

Chrome version: 67.0.3382.0  Channel: canary
OS Version: 8.1
Flash Version: 

The example in github for svgomg.firebaseapp.com needs a signed apk to go with it for TWA to work: https://github.com/GoogleChrome/custom-tabs-client/tree/master/svgomg. I can't find one in the github repo or Play Store. There is an assetlinks.json file for this domain with two signing key SHA256 hashes.
 
Labels: Needs-triage-Mobile
Cc: pnangunoori@chromium.org
Components: UI>Browser>Mobile>CustomTabs
Labels: Triaged-Mobile Needs-Feedback
markst3v3ns@ -- Thanks for reporting this issue. Could you please share the sample .APK file to reproduce the issue along with the screen cast for the better understanding of the issue.

Also, please share the device details where the issue is reproduced.

Thanks!
Right, what you describe is the behavior if verification fails, which is roughly speaking falling back to showing the web content in a Chrome Custom Tab.https://developers.google.com/web/updates/2017/10/using-twa#deploy_your_assetlinksjson_to_prove_ownership_of_the_domain describes how to troubleshoot Digital Asset Links.
Apk and screenshot attached. The hash in the asset links file: https://my.agcore.co.uk/.well-known/assetlinks.json is from the key used to sign the apk. The app was created with classes from the custom-tabs-client github example slightly modified to only use Chrome Canary. Screenshot taken on Pixel 2 with Android 8.1 and Chrome Canary 67.0.3389.0.
device-2018-04-06-103010.png
65.8 KB View Download
twa-test.apk
1.3 MB Download
Project Member

Comment 5 by sheriffbot@chromium.org, Apr 6 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Blocking: 800418
Cc: peconn@chromium.org
Labels: -Pri-2 Pri-1
Status: Available (was: Unconfirmed)
Summary: OriginVerifier doesn't trim trailing slash from domain name (was: Trusted Web Activity address bar visible)
Thanks!

It appears that Chrome fetches this URL to verify: https://digitalassetlinks.googleapis.com/v1/assetlinks:check?source.web.site=https%3A%2F%2Fmy.agcore.co.uk%2F&target.androidApp.packageName=com.example.twa&target.androidApp.certificate.sha256Fingerprint=AD%3A8F%3AB5%3A55%3AF2%3A6F%3AB2%3AB7%3AAA%3AF2%3A8F%3A46%3A23%3A3C%3A67%3AFC%3A9A%3ABC%3A7C%3A15%3A22%3AB1%3ABF%3AEB%3A31%3A7F%3A3F%3A12%3ACF%3A8A%3AF7%3A8F&relation=delegate_permission%2Fcommon.handle_all_urls

which returns a 400 error. The correct URL doesn't have a slash at the end of the web site to verify (just https://my.agcore.co.uk).

+Peter who worked on issue 800422.
Good to know what the problem was! So will this be fixed server side at digitalassetlinks.googleapis.com or client side?
Client-side in Chrome.
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 17 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/08bb73244fe60b9f6f1e1e4c636a88931730f918

commit 08bb73244fe60b9f6f1e1e4c636a88931730f918
Author: Peter E Conn <peconn@chromium.org>
Date: Tue Apr 17 16:06:28 2018

🤝 Remove trailing slash from Origin.

GURLUtils.getOrigin returns an origin formatted with a trailing slash
because it calls GURL::GetOrigin which returns a GURL, then serializes
this URL. This seems to be incorrect behaviour as more generally an
origin is serialized without a trailing slash.

GURLUtils.getOrigin is used by AwGeolocationPermissions.java where the
returned value is saved to the user's Android Preferences. This means
that changing its behaviour would be tricky.

For now, I'm updating Origin.java to serialize without a trailing
slash and documenting the deviance in behaviour between the two.

Bug:  827161 
Change-Id: Ia70f8a60263742b28477f969cc075dcb97062f48
Reviewed-on: https://chromium-review.googlesource.com/1013483
Reviewed-by: Matt Menke <mmenke@chromium.org>
Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
Commit-Queue: Peter Conn <peconn@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551351}
[modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/chrome/android/java/src/org/chromium/chrome/browser/browserservices/Origin.java
[modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/OriginTest.java
[modify] https://crrev.com/08bb73244fe60b9f6f1e1e4c636a88931730f918/net/android/java/src/org/chromium/net/GURLUtils.java

Cc: -peconn@chromium.org markst3v...@gmail.com
Owner: peconn@chromium.org
Status: Fixed (was: Available)
markst3v3ns, provided this change doesn't break something and get reverted, this should be available for you to try in Chrome Dev in a few days.
Thanks!
I can confirm its fixed in Chrome Canary 68.0.3434.0
Status: Verified (was: Fixed)
Cool, thanks for verifying!

Sign in to add a comment