Skip to content

Avoid launching apps for HTTP navigations not initiated by the user#8520

Draft
kzar wants to merge 1 commit into
developfrom
kzar/bugfix/cct-app-loop
Draft

Avoid launching apps for HTTP navigations not initiated by the user#8520
kzar wants to merge 1 commit into
developfrom
kzar/bugfix/cct-app-loop

Conversation

@kzar
Copy link
Copy Markdown
Collaborator

@kzar kzar commented May 11, 2026

Task/Issue URL: https://app.asana.com/1/137249556945/inbox/1200776578788342/item/1211781703927439/story/1214682781164811?focus=true

Description

The Wall Street Journal (WSJ) app sometimes loads articles inside a Chrome
Custom Tab (CCT)[1]. When it does, if the user's default browser was set to
DuckDuckGo, they could sometimes be trapped in a CCT -> App Link redirection
loop, as their phone switched from the DuckDuckGo browser, back to the WSJ, and
back again repeatedly.

It turns out, that Chromium has some logic[2] to ensure that such navigations
are user-initiated before opening the registered app for it. Let's do the same.

Notes:

  • The isUserQuery() check allows navigations that were initiated by the user
    via the address bar to then be opened in an app.
  • Non-HTTP App Links are handled via handleNonHttpAppLink which isn't changed
    here. Chromium seems to force a user prompt for non-user-initiated non-HTTP
    navigations, we could consider doing the same in the future.

1 - https://developer.chrome.com/docs/android/custom-tabs
2 - https://source.chromium.org/chromium/chromium/src/+/09aafe21bc1b6c78e92fa4197d4e3c8401caaee9:components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java;l=1230-1235

Steps to test this PR

  1. DDG as default browser, Settings → Permissions → "Open Links in Apps" = "Always"
  2. Install the WSJ Android app, and sign in to a paid account.
  3. In the WSJ app, open articles until you find one that opens in the custom tab (with DDG browser).
  4. Ensure you can then read the article OK, instead of being redirected in an infinite loop.

The Wall Street Journal (WSJ) app sometimes loads articles inside a Chrome
Custom Tab (CCT)[1]. When it does, if the user's default browser was set to
DuckDuckGo, they could sometimes be trapped in a CCT -> App Link redirection
loop, as their phone switched from the DuckDuckGo browser, back to the WSJ, and
back again repeatedly.

It turns out, that Chromium has some logic[2] to ensure that such navigations
are user-initiated before opening the registered app for it. Let's do the same.

Notes:
 - The isUserQuery() check allows navigations that were initiated by the user
   via the address bar to then be opened in an app.
 - Non-HTTP App Links are handled via `handleNonHttpAppLink` which isn't changed
   here. Chromium seems to force a user prompt for non-user-initiated non-HTTP
   navigations, we could consider doing the same in the future.

1 - https://developer.chrome.com/docs/android/custom-tabs
2 - https://source.chromium.org/chromium/chromium/src/+/09aafe21bc1b6c78e92fa4197d4e3c8401caaee9:components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java;l=1230-1235
@kzar kzar force-pushed the kzar/bugfix/cct-app-loop branch from 839a1c7 to fa6117e Compare May 11, 2026 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants