App doesn't indicate when external content is displayed

[s-jairl]

Problem description

When the app redirects the user to an issuer or verifier, there is no visual indication that the user is viewing an external web site and not the main app (see attached video).

wwwallet_android-no_hint_webview_switch.mp4

Besides being potentially confusing, it could also lead to security issues - the issuer/verifier web site could be styled to look like the main wwWallet app and trick the user into giving away their passkey PIN or other sensitive information.

Proposed solution

Add a "banner" or something similar to a browser URL bar that indicates that what external content is being displayed.

[tladesignz]

Interesting. The wwWallet app should actually send you to the browser, if you open anything, which is not in the configured BASE_DOMAIN.

[tladesignz]

Can you please tell us what you scanned there, so we can reproduce?

[s-jairl]

I scanned the QR code from a demo issuer that contained "https://id.siros.org/id/demo/cb?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fdemo.issuer.id.siros.org%22%2C%22credential_configuration_ids%22%3A%5B%22pid_1_5%22%5D%2C%22grants%22%3A%7B%22authorization_code%22%3A%7B%7D%7D%7D"

[s-jairl]

I guess it could depend on how the "BASE_DOMAIN" is interpreted - the wallet is hosted on the "id.siros.org" domain, which is the base for "demo.issuer.id.siros.org".

[tladesignz]

Ah. Forgot, that this isn't deployed, yet: 6877b9c

I'll release version 0.1.5 ASAP. Let me know, if it works with that. (Or close the issue, when it does.)

[tladesignz]

There you are: https://github.com/wwWallet/wallet-android-wrapper/releases/tag/v0.1.5