Address bar still visible even with digital asset link - trusted-web-activity

We have a PWA hosted at www.thredup.com that is published as a TWA in the Play Store for closed testing. The digital asset link is OK but the address bar is still visible in the TWA.
Is there something wrong with the digital asset link that would prevent the address bar from hiding? Do we need to do something else to hide the address bar other than setting up the digital asset link?
The digital asset link for the TWA (package com.thredup.www.twa) is available at www.thredup.com/.well-known/assetlinks.json.
{
"relation": ["delegate_permission/common.handle_all_urls"],
"target": {
"namespace": "android_app",
"package_name": "com.thredup.www.twa",
"sha256_cert_fingerprints": ["B5:B4:0C:36:87:C1:1B:74:02:90:18:14:D8:52:F9:45:62:81:BC:F4:A1:AD:23:07:66:3E:2D:A0:06:10:99:1D"]
}
}
We're using the SHA 256 of the Google App signing key (not the upload key) for the Play Store listing in the digital asset link.
The Asset Links Tool app on Android shows the same digital asset link for the com.thredup.www.twa package when TWA is installed on device.
Testing the app linking using the Statement List Generator and Tester validates host www.thredup.com is granting app deep linking to com.thredup.www.twa.
The only way I found to hide the TWA address bar is to disable the digital asset link verification for www.thredup.com url using Chrome command line as described here: https://github.com/GoogleChromeLabs/svgomg-twa#enabling-debug

I'd recommend running Peter's Asset Link Tool on the application installed from the Play Store. It will give you the correct Asset Links file (which you can compare to the one currently being used).

Have you ever upload assetlinks.json with upload key(old key) and install apk?
Then the chrome browser will save old key in cache.
So you can try to install again after clear cache of chrome.

Related

How test an app link to an instant app as a closed test

I have tested successfully a debug version of an instant app that is called by an app link, e.g., https://domain/?q=1234567. I have created a release version and signed it with a "Create new" key. Upload to a new Closed Testing release fails, however, because the Bundle is signed "with the wrong key".
What am I doing wrong in trying to test a release version without Publishing publicly? Do I have to go forward to Publish and rely on my previous debug testing of the app link or is there a way to verify the app link operation in closed testing?"
It took a lot of digging, but I found the answer here:
https://developer.android.com/studio/run/rundebugconfig
It is the documentation for "Create and edit run/debug configurations".
It says:
URL - Launch a URL that matches an intent filter in your app's
manifest. When selected, the URL field appears below, where you can
enter the URL.
You must fill in this field to launch an Android Instant App. You may
also use this to test your Android App Links.
This confirms that my successful testing of my app link to initiate my instant app proves it will work in release form when it is published.

Upload pre-installed app to playstore shows error

While uploading app on Google playstore, we are getting below error.
You need to use a different package name because [pkg_name] is used by
a pre-installed application. To upload a pre-installed application,
please contact Google Play Developer Support.
I am sure that mentioned pkg name is unique, however we have pre-installed this app in some of devices. Now how to upload it to Play console ?
I got this solved by using contact support team of Google, They then contacted carrier/preload team to allow package.
Sometimes if you preload app first and then publish app on Playstore, Google play will block the package and confirm your identity from pre-load team before allowing you to publish.
So it is advised to put package in store first & then pre-load to avoid such long process. (You can limit discovery via multiple ways).
Source - https://medium.com/#shashank.mishra_62841/complete-guide-in-app-update-for-android-apps-google-playstore-1b8f2946fa7a

how to monitor image requests for a react-native app to verify if images are loaded from cache or not (using Charles)

I am trying to monitor the requests for images to verify whether the images are loaded from the ios/android cache or they are still being requested from the backend firebase storage. I am using React Native Debugger by enabling Network Inspect but can't seem to observe the requests for images (URIs) of react-native "image" components. How can I monitor the requests for images or how can I check whether the images are loaded from the cache or not?
Thanks!
According to the React Native Debugger documentation here: https://github.com/jhen0409/react-native-debugger/blob/master/docs/network-inspect-of-chrome-devtools.md
It can't inspect request like Images loaded from urls for src, so if
your Image source has a set session, the session can't apply to fetch
and XMLHttpRequest.
The same document refers to Charles & stetho for monitoring these kinds of requests.
If you want to inspect deeper network requests (like requests made
with Image), use tools like Charles or Stetho.
I installed Charles on my mac, installed the certificate on my iOS device, and enabled it using the information contained on the below links. Now I am able to monitor the requests for images.
1- https://www.charlesproxy.com/documentation/getting-started/
2- https://www.donnywals.com/debugging-network-traffic-with-charles/
3- https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
4- https://stackoverflow.com/a/49129286/1680793
(You may need to visit other linked pages on the links I listed above as needed)
Install Charles on you Mac, launch this help action as described in the documentation I listed:
Charles will guide you about how to install and trust the required certificate on your device:
Some important points:
When you install Charles on your Mac/PC, if it asks for making the
required configurations automatically, allow it.
To install the certificate on your ios device browse to
chls.pro/ssl URL using the SAFARI browser, not Chrome. Then
follow the instructions your device displays to install the
certificate. (I was especially interested in monitoring my iOS device
since android seems to cache the images by default)
If you are using firebase storage as your image store (as I do) and can't see the requests/responses being recorded by Charles, lookout for a message like this: SSL Proxying not enabled for this host. Enable in the Proxy Menu, SSL Proxying Settings
You need to enable SSL proxying for https://firebasestorage.googleapis.com. Add firebasestorage to SSL proxying configuration like so (or whatever URL you are interested in monitoring the communication with):
Charles will be recording everything going on with your mac, to
observe just the "firestore" requests from your app for your images,
use the "filter" box at the bottom of the structure tree on the left
pane (see the first image above).
Don't forget to disable your WIFI proxy after you are done with
Charles or you will not be able to connect to the internet.
Make sure you follow the documentation carefully and pay attention to my list here.
Charles is a paid tool. You can use the trial version for 30 days.
And each launch will terminate itself after 30 mins, so you will need
to restart Charles.

How to set "Your name"

I cannot find any documentation or examples so I'm looking for guidance. When my Instant app is downloaded it shows up in Settings>Google>Google Play Instant with the app name and below that "Your Name". Other apps have found how to set "Your Name", for example, The NYTimes - Crossword has "The New York Times Company".
Is there a variable in a Manifest or a gradle file that needs to be filled?
I found out from Google Developer Support that the problem occurs if Instant Apps Dev Manager is installed and/or when the app is sideloaded.
The fix was to Uninstall IA Dev Manager, Clear App Data for my Instant App then re-execute the download from the Play Store. Checking Settings>Google>Google Play Instant the Instant App appears and the company name from my listing of the app with the Play Store shows up underneath. There is no Manifest or gradle attribute to supply; it comes from the Play Store automatically - if it's not blocked.

iOS - Prevent iPhone Configuration Profile from being deleted OR check to see if it's installed

I'm working on an iOS enterprise app that relies on an Configuration Profile being put on the phone. Unfortunately, the user can "cancel" this profile, which really screws with our app.
So I was wondering if a) is it possible to prevent a configuration profile from being deleted OR
b) is there a way to check to see if a configuration profile is installed already (say, at runtime, then we can just install it again if it's not there)?
If you want the configuration profile not to be tampered with / disabled by the user, this is possible! If you're using Apple Configurator to build your .mobileconfig file in the generals tab select security as never. Be aware: once the profile is installed on the device it cannot be reverted unless you restore the device
The long story short is there is no current documented way to even programmatically call / install a configuration profile (.mobileconfig) file onto the device: so if you're thinking about checking whether the profile exists and if not to install it, it's impossible (as for available documentation thus far) - if you do find a way let me know
Note:
.mobileconfig files can only run through Safari / Mail.
This similar SO discussion may help: Installing a configuration profile on iPhone - programmatically
It is possible to check is .mobileconfig is installed.
What you need to do is:
Create CA (certificate authority) and export it as .cer.
Issue certificate using created CA and export is as well as .cer.
Using Apple Configurator app add CA .cer in the certificates area.
Mobile configuration profile will have CA .cer.
Issued certificate (on step two) add to app bundle.
Using Security framework evaluate (SecTrustEvaluate) issued
certificate on step 2.