New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 856407 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Long OOO (go/where-is-mgiuca)
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug

Blocking:
issue 799835



Sign in to add a comment

Desktop PWAs: Origin should be ETLD+1

Project Member Reported by mgiuca@chromium.org, Jun 26 2018

Issue description

Chrome Version: 69
OS: Chrome

We currently show the full origin in the title bar [1], but I think we should instead be showing the ETLD+1, since we are trying to standardize the notion of identity around that.

I will confirm with Security.

[1] https://cs.chromium.org/chromium/src/chrome/browser/ui/extensions/hosted_app_browser_controller.cc?q=HostedAppBrowserController::FormatUrlOrigin
 
Note that  Issue 799835  tracks standardising on the origin across all installability surfaces, including the desktop PWA window frame. All other surfaces show the origin, so just changing the window frame would be inconsistent and it would be good to have a solid reason for the inconsistency.

Comment 2 by mgiuca@chromium.org, Jun 26 2018

Blocking: 799835

Comment 3 by mgiuca@chromium.org, Jun 26 2018

Ah OK, interesting.

So it *was* ETLD+1 but r542763 (which added the animation) changed to origin, which was by agreement at the time (see  Issue 809794 ).

Looks like Dom has completed an effort to standardize on origin (per  Issue 799835 ) so we should stick with it, or change all of these surfaces to ETLD+1.
We updated the enamel Guidelines for URL display to standardize on origin:

https://docs.google.com/document/d/1a4aamAaknVXtDkNePPg0ikeAKsJKdWGBND7fFuliChA/edit#

When the primary purpose of displaying a URL is to have the user make a security decision, display the origin. Omit the path, query string, fragment, and any other components of the URL because they provide opportunities for spoofing.
Do not display the scheme if it will always be https://. If the scheme is not https://, prefer to show a security indicator icon (dangerous triangle icon + “Not Secure” string on http://) rather than the scheme itself.
We remove subdomains “www” and “m” as a special case to simplify the origin (except when they are part of the registrable domain).
If in a space-constrained environment, it's acceptable to use registrable domain instead of the full origin.
Status: WontFix (was: Unconfirmed)
WontFixing as per #4, though this may be changed in future based on updated advice. :)

Sign in to add a comment