This question already has answers here:
Disable Chrome Password Manager through Karate framework
(2 answers)
Closed 1 year ago.
I know that I can pass addOptions for example for native chrome:
addOptions: [ '--incognito' ]
however, the addOption only works for the native chrome not with chromedriver,
I tried to pass in this as a
def session = { capabilities: { browserName: 'chrome' }, desiredCapabilities: { addOptions: '--incognito' } }
but I don't think it is getting picked up as well when I pass this session in.
I have to use incogonito as chrome will otherwise log my LDAP in when I am my company VPN. I want my test program under a service account.
It all depends on whether whatever driver executable you are calling supports that option or not, Karate just passes it.
You are welcome to do some research and contribute your findings (and ideally code) to this open-source / community.
Related
I have been having a long and frustrating experience trying to get AASA to work for webcredentials. My goal here is to allow usernames and passwords to be stored in the iOS keychain.
I did have this working on a root domain the other week but it is not sufficient for my scenario as I will explain. It didn't work for me straight away I have to say but it eventually started working after a clean build so I thought this was the issue then but now I am not so sure.
I am using Expo with EAS build. We have a multi-tenant application. From a single codebase we deploy to multiple apps in the store. All are on the same team ID but they are separate applications and use separate credentials, nothing is shared.
I am confident my apps textContentType of username and password on my TextFields is correct as this has not changed from when I managed to get it working originally and I have checked it countless times.
Expectation
For the "Save Password" prompt to be displayed after login. What I have noticed however is when going to store a password manually using "add password" via iCloudKeychain from the keyboard accessory this does accurately show the correct "TENANT_SUBDOMAIN.example.com". I find this confusing.
Goal Scenario
I am hosting a site on Netlify. I have it setup to support wildcard subdomains with a LetsEncrypt provisioned wildcard SSL certificate. I then have edge functions which change the content of my index.html and apple-app-site-association file dynamically based on the requested subdomain.
I have added the Associated Domains capability to my provisioning profile.
I am using the latest Expo 47 and EAS build. I have added in the appropriate associated domains configuration and I can see this when introspecting my entitlements under com.apple.developer.associated-domains and it is correct.
I am using TestFlight for testing. I am doing a --clean-build on EAS every time and I also increase the runtime version. I have also tried manually refreshing credentials outside of the build process which does this automatically. This must be using the correct provisioning profile otherwise I would get a build failure as the requested entitlements wouldn't match.
The AASA file is currently hosted just in the .well-known directory. I have tried using the root and also tried using both. There are no redirects taking place.
I am aware the AASA file is pulled on application installation and update. I repeatedly remove the apps and then reboot my phone in an attempt to reset any device caches.
The content-type of the file is application/json and I have confirmed this using developer tools in the browser.
There is no robots.txt or anything blocking the request from an infrastructure perspective. There are no additional firewalls or geo restricted access as I am just using plain Netlify to host this, nothing fancy.
I am confident the Team ID and bundle IDs are correct in the AASA file.
I remove the content-length header in the Edge function so it is correctly calculated by the network instead and I have confirmed this using curl.
When I check the file using https://app-site-association.cdn-apple.com/a/v1/site.example.com Apple has the correct file cached on it's CDN so I would expect it to work.
I added in an applinks section so I could use the Apple App Search API validation tool and the Branch.io AASA verification tool to verify correctness. Branch.io says the file is fine and Apple says it's fine also but because the App has not been deployed to the store yet I see Error no apps with domain entitlements. From what I can tell this is normal in development and makes sense as it uses the current released version of the app to verify the deep link configuration. So to me this means Apple can parse the file correctly.
When I stream my device console logs; on install I can see the AASA requesting the correct domains. I see no errors on swcd I just see the Beginning data task AASA-XXXX with the correct domains.
When I run Charles proxy on my phone with a verified SSL installation (also reinstalled a few times now) I do not see quite what I would expect - but the device logs seem to imply it is doing the correct thing. When I view the app-site-association... URL requests in Charles there is one per application install which is correct. The request is marked as Unknown and when I look at the request the host is shown but as you would expect from SSL I see no path. The info says METHOD: CONNECT with Error - Input Error: EOF. This is the only error I see, I am not sure if it is a red herring and something to do with Charles. Given the error as you expect there is no body in the request or response. It is worth noting in general testing I have no VPN enabled and I have do not have Private Relay enabled in my iOS settings.
When I perform a sysdiagnose I see the following at the timestamp in my console log in the swcutil_show.txt device log. This looks correct in comparison to other apps webcredentials and applinks services I see there and I see no errors:
Service: webcredentials
App ID: MYTEAMID.com.cf.example.b2c.ios
App Version: 1.0
App PI: <LSPersistentIdentifier 0x141816200> { v = 0, t = 0x8, u = 0x1e7c, db = 0094F7C4-3078-41A2-A33E-79D5A62C80A6, {length = 8, bytes = 0x7c1e000000000000} }
Domain: CORRECT_SUBDOMAIN.example.app
User Approval: unspecified
Site/Fmwk Approval: approved
Flags:
Last Checked: 2022-12-09 14:14:32 +0000
Next Check: 2022-12-14 14:03:00 +0000
Service: applinks
App ID: MYTEAMID.com.cf.example.b2c.ios
App Version: 1.0
App PI: <LSPersistentIdentifier 0x13fd38d00> { v = 0, t = 0x8, u = 0x219c, db = 0094F7C4-3078-41A2-A33E-79D5A62C80A6, {length = 8, bytes = 0x9c21000000000000} }
Domain: CORRECT_SUBDOMAIN.example.app
Patterns: {"/":"*"}
User Approval: unspecified
Site/Fmwk Approval: approved
Flags:
Last Checked: 2022-12-13 13:13:23 +0000
Next Check: 2022-12-18 13:01:51 + 0000
At end of file:
MYTEAMID.com.cf.example.b2c.ios: 8 bytes
(This seems correct for all apps)
Other Scenario
I have tried setting this up using an apex on another domain which hasn't been seen before by Apple. I have tried using a subdomain with a root domain serving the same content and I have tried the subdomain and root domain on their own. I have also tried not using the Edge functions and having static files but to no avail.
When I do this I ensure I wait for the Apple CDN to catch up and remove/add entries prior to deleting the apps, rebooting my device, and reinstalling to test.
AASA File
AASA content comes back with the correct payload and Content-Type: application/json and Content-Length headers, both from Apples CDN and the origin. When I had this somehow working in my initial test it was on a root domain and I did not have an applinks section, this was only added so I could use the verification tools for universal links.
I am not sending back different content or duplicated content and I block the www subdomain - I have also tried it with a www subdomain for the record.
{
"applinks": {
"details": [
{
"appIDs": [
"MYTEAMID.com.cf.example.b2c.ios"
],
"components": [
{
"#": "no_universal_links",
"exclude": true,
"comment": "Matches any URL with a fragment that equals no_universal_links and instructs the system not to open it as a universal link."
}
]
}
]
},
"webcredentials": {
"apps": [
"MYTEAMID.com.cf.example.b2c.ios"
]
}
}
I have also tried this with the older format:
{
"applinks": {
"apps": [],
"details": [
{
"appID": "MYTEAMID.com.cf.example.b2c.ios",
"paths": [
"*"
]
}
]
},
"webcredentials": {
"apps": [
"MYTEAMID.com.cf.example.b2c.ios"
]
}
}
associatedDomains iOS. expo config
associatedDomains: [
`webcredentials:${SUBDOMAIN}.example.app`,
`applinks:${SUBDOMAIN}.example.app`,
],
Help :)
I have been trying to get this to work for a long time now and I am completely out of ideas. If anybody has any suggestions I would really appreciate it. I am very confused how the devices request seems correct and the CDN content is correct but it is still not working. It's worth also reiterating that I need to have different subdomains for each tenant as the credentials must not be shared across apps so the keychain->domain association store must be different.
I am wondering if it's the LetsEncrypt wildcard SSL certificate but I wouldn't expect it to verify and for Apple to cache the file if this was the case. It seems very unlikely to me but it is the only thing I haven't tried at this point.
Many Thanks,
Mark
I am creating CloudFormation stack with Elasticsearch service, however it fails for AdvancedSecurityOptions, which works perfectly fine with aws es create-elasticsearch-domain
my JSON template snippet is below:
...
"AdvancedOptions": {
"rest.action.multi.allow_explicit_index": true
},
"AdvancedSecurityOptions": {
"Enabled": true,
"InternalUserDatabaseEnabled": false,
"MasterUserOptions": {
"MasterUserARN": "arn:aws:iam::1234567890:role/role_name"
}
},
"DomainName": {
"Ref": "ESDomainName"
}
...
I am unable to get this code working, any help related to fine grain access control would be really appreciated.
The AdvancedSecurityOptions is the latest addition to Amazon Elasticsearch service added recently as part of Fine Grained Access Control. This is available only via Console, CLI and API for now.
I am not sure if the thread is with outdated info, but according to the official AWS documentation on this link it should be possible to use the AdvancedSecurityOptions for Fine Grained Access Control. It even states that it is meant to be used for FGAC at the top of the page.
Continuing from DNakevski# answer above, for FGAC we need to ensure the following three settings in the CFN template are set to true since they serve as pre-requisites:
EncryptionAtRestOptions
NodeToNodeEncryptionOptions and
HTTPS.
Further, the important parameter for FGAC in the CFN template is AdvancedSecurityOptions and needs to be set to Enabled: true
AmazonES/Opendistro-for-ES provides two ways for security with FGAC. One is through using a IAM user as a master-user and other is through having basic auth.
If you need to take the IAM way then set the InternalUserDatabaseEnabled to false and only have the parameter *MasterUserARN: "IAM User ARN" under the MasterUserOptions field.
If you need to take the basic auth (username and password) approach set the InternalUserDatabaseEnabled to true and have the MasterUserName: "any-name" and the MasterUserPassword: "xxx"* Please have at least one lower case, one upper case, one digit and one special character for the password else the CFN template will rollback. However, the failure message is easily seen on the CFN console under events.
I have a simple working CFN yaml here doing the same just in case.
I am developing a Chrome extension on windows. It also has a native messaging host. The argument passed to the host named --parent-window is in my case always 0.
According to the Native Messaging Protocol it says
On Windows, the native messaging host is also passed a command line
argument with a handle to the calling chrome native window:
--parent-window=. This lets the native messaging host create native UI windows that are correctly focused.
I open my port for native messaging in the background JS. My understanding is that you cannot use this API in content.
This Chromium Bug appears to be my issue but it was closed as a won't fix.
So when or in what circumstances does Chrome send something useful with the --parent-window?
Further on May 7 the writer who I assume knows a bit about chromium says
Haven't tried it, but could you open your native messaging port in a
content script instead? Sounds like the --parent-window arg might be
useful in that case.
What does he mean and how do I do this?
Answering my own question. In short it does not work as you would expect if you are a windows developer. Possibly comment 2 helps from the "Wont Fix" issue on Chromium.
Comment 2 seems to explain when it might work.
If you are using Native Messaging
(https://developer.chrome.com/extensions/messaging#native-messaging),
it would seem like the --parent-window command line parameter would
provide a solution. Unfortunately, zero is passed for the parent
window if the native messaging connection is made from a background
page and (apparently) the HWND of a transient popup window is passed
if the native messaging connection is made from a browser action
popup. And I am not allowed to call chrome.runtime.connectNative()
from a content script. Therefore, in my extension at least,
--parent-window is not helpful.
My solution is immediately after
port = chrome.runtime.connectNative('myspecial.host.application');
I then use the following;
chrome.tabs.query({ active: true, currentWindow: true }, function (tab) {
console.log(tab[0].title);
port.postMessage({ MessageType: 'chromeTitle', Message: tab[0].title });
});
In your host if you add to this titel " - Google Chrome" then you can call FindWindowEX with the class "Chrome_WidgetWin_1" and the title to get the main handle of Google.
I need to get the network events from Chrome. I've found this:
https://developer.chrome.com/devtools/docs/debugger-protocol
https://developer.chrome.com/devtools/docs/protocol/1.1/network#command-enable
It seems that Chrome uses a port to get messages, answer and send events, for remote debugging. It says it uses JSON, so I decided to try it.
So, I wrote some simple java code that opens the port that chrome is listening on (ofcourse i've started it by using google-chrome --remote-debugging-port=9222 on my ubuntu machine). I have a thread that writes to stdout anything coming from this port, and then the code writes this to the outputstream of the socket using this line (a sample method from the protocol):
out.println("{\"id\": 1,\"method\": \"Network.enable\"}");
I would expect some answer (according to the protocol) in the input stream but nothing happens.
Does anyone ever done something like this? I can't find anything on the net.
Finally I've got it. Credit goes to https://www.igvita.com/2012/04/09/driving-google-chrome-via-websocket-api/.
First I send an HTTP request to http://localhost:9222/json. This returns a JSON list of open tabs in Chrome, for each I also get a WebSocket uri (webSocketDebuggerUrl):
[
{
"description": "",
"devtoolsFrontendUrl": "/devtools/devtools.html?ws=localhost:9222/devtools/page/C014A09F-BD0A-40BA-B23C-7B18B84942CD",
"faviconUrl": "http://cdn.sstatic.net/stackoverflow/img/favicon.ico?v=00a326f96f68",
"id": "C014A09F-BD0A-40BA-B23C-7B18B84942CD",
"title": "Using Google Chrome remote debugging protocol - Stack Overflow",
"type": "page",
"url": "https://stackoverflow.com/questions/28430479/using-google-chrome-remote-debugging-protocol",
"webSocketDebuggerUrl": "ws://localhost:9222/devtools/page/C014A09F-BD0A-40BA-B23C-7B18B84942CD"
}
]
Then I can use WebSocket to send messages for debugging a specific tab, using this URI. I also found this for using Jetty implementation of WebSocket: javax.websocket client simple example.
This question already has answers here:
How to inspect contents of storage.local in Chrome Packaged App?
(2 answers)
Closed 8 years ago.
I am developing a chrome app that needs to save some data to the local storage and retrieve it afterwards.
I follow the guides on the Chrome storage API
https://developer.chrome.com/extensions/storage
and have a simple code to save data:
function saveCurrentPort()
{
chrome.storage.local.set({'last_port': connectedPortPath}, function() {
// Notify that we saved.
writeConsole('JS last port saved:' + connectedPortPath );
if (chrome.extension.lastError) {
alert('JS An error occurred: ' + chrome.extension.lastError.message);
}
});
}
After calling this with valid data, nothing gets saved in the local storage. Looking into the Resource tab in the developer tools window for my App I see no entry in the Local Storage section (nor in the Session Storage).
Of course, attempting to retrieve this data fails because the data isn't found.
This should be straight forward but simply doesn't work for me.
I run the App locally in developer mode.
Looking for other questions here I didn't see a case like this.
Any idea why it isn't working? am I missing something?
Thanks
Did you declare the "storage" permission to your manifest.json?
{
"name": "My extension",
...
"permissions": [
"storage"
],
...
}
Plus, alert() is not allowed from chrome app.
I think there must be more errors. you might need to fix it first.
Besides permission you need to put the value of 'last_port'
var last_port_var= 'last_port';
var portObj= {};
portObj[last_port_var] = connectedPortPath;
Now set the value by object:
chrome.storage.local.set(portObj, function() {
//code goes here....
}
Hope this helps.