[cws-apps] Blocking URLs in a Packaged Kiosk App

[Matthew Hughey - Technology]

I am trying to build a "locked down browser" app. Basically it is just a
kiosk app that only goes to one website. I have that setup and working
great. The point of this app is for our students to take tests, so they
cannot use the Internet to find answers to questions.

The issue is that our testing website uses Google SSO. Students find when
they click on any of the additional "create account," "learn more," etc.
links found on the Google login page, they can eventually click their way
to the Google search page and have unfiltered Internet access.

How can I modify a kiosk packaged app to include specific blacklisted URLs?

Thanks,

{
"app": {
"background": {
// Optional
"scripts": [
"js/foam.js",
"js/cab.js",
"config.js",
"background_main.js"]
}
},
"manifest_version": 2,
"name": "LSR7 Schoology Locked Browser",
"version": "0.3",

"default_locale": "en",
"icons": {"128":"img/128.png"},

"permissions": [
"webview",
"power",
"storage",
"videoCapture",
"geolocation",
"pointerLock",
"system.display",

{"fileSystem":["write","retainEntries","directory"]},"accessibilityFeatures.read","accessibilityFeatures.modify"
]
}
--
CONFIDENTIALITY NOTICE AND DISCLAIMER:  This e-mail and any attachments
may be confidential and may contain privileged or copyright information. 
If you are not the intended recipient, please call [phone] and
inform us that you have received this message in error.   Please do not
copy, distribute or use this e-mail or the information contained in it for
any purpose.

[PhistucK]

I guess that depends on how you implement this application. Are you using
<webview>? If so, I believe it has a JavaScript API for monitoring/blocking
navigation. loadstart
<https://developer.chrome.com/apps/tags/webview#event-loadstart> or
loadcommit <https://developer.chrome.com/apps/tags/webview#event-loadcommit>
events
come to mind.

☆*PhistucK*


On Fri, Oct 19, 2018 at 4:58 PM Matthew Hughey - Technology <

Post by Matthew Hughey - Technology
I am trying to build a "locked down browser" app. Basically it is just a
kiosk app that only goes to one website. I have that setup and working
great. The point of this app is for our students to take tests, so they
cannot use the Internet to find answers to questions.
The issue is that our testing website uses Google SSO. Students find when
they click on any of the additional "create account," "learn more," etc.
links found on the Google login page, they can eventually click their way
to the Google search page and have unfiltered Internet access.
How can I modify a kiosk packaged app to include specific blacklisted URLs?
Thanks,
{
"app": {
"background": {
// Optional
"scripts": [
"js/foam.js",
"js/cab.js",
"config.js",
"background_main.js"]
}
},
"manifest_version": 2,
"name": "LSR7 Schoology Locked Browser",
"version": "0.3",
"default_locale": "en",
"icons": {"128":"img/128.png"},
"permissions": [
"webview",
"power",
"storage",
"videoCapture",
"geolocation",
"pointerLock",
"system.display",
{"fileSystem":["write","retainEntries","directory"]},"accessibilityFeatures.read","accessibilityFeatures.modify"
]
}
*CONFIDENTIALITY NOTICE AND DISCLAIMER: * This e-mail and any attachments
may be confidential and may contain privileged or copyright information.
If you are not the intended recipient, please call [phone] and
inform us that you have received this message in error. Please do not
copy, distribute or use this e-mail or the information contained in it for
any purpose.
--
You received this message because you are subscribed to the Google Groups
"Chromium-Apps-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an
Visit this group at
https://groups.google.com/a/chromium.org/group/chromium-apps/.
For more options, visit https://groups.google.com/a/chromium.org/d/optout.

[Matthew Hughey - Technology]

I do plan on using webview. I found this sample from Google's developer
site:

webview.request.onBeforeRequest.addListener(
function(details) { return {cancel: true}; },
{urls: ["*://www.evil.com/*"]},
["blocking"]);

But when I add that to my background_main.js file, It returns an error
saying the webview is not defined. Sadly I don't have a lot of experience
with JavaScript, so I'm not sure how or where in my file structure to
define webview. Thoughts?

Thanks.

*--*
*Matthew Hughey*
District Technology Specialist - Lee's Summit R7 School District
301 NE Tudor Rd. / Lee's Summit, MO 64086
816.986.1089 (Office)
---------------------------------------------------------------------------------------------------------------------

Post by PhistucK
I guess that depends on how you implement this application. Are you using
<webview>? If so, I believe it has a JavaScript API for
monitoring/blocking navigation. loadstart
<https://developer.chrome.com/apps/tags/webview#event-loadstart> or
loadcommit
<https://developer.chrome.com/apps/tags/webview#event-loadcommit> events
come to mind.
☆*PhistucK*
On Fri, Oct 19, 2018 at 4:58 PM Matthew Hughey - Technology <

Post by Matthew Hughey - Technology
I am trying to build a "locked down browser" app. Basically it is just a
kiosk app that only goes to one website. I have that setup and working
great. The point of this app is for our students to take tests, so they
cannot use the Internet to find answers to questions.
The issue is that our testing website uses Google SSO. Students find when
they click on any of the additional "create account," "learn more," etc.
links found on the Google login page, they can eventually click their way
to the Google search page and have unfiltered Internet access.
How can I modify a kiosk packaged app to include specific blacklisted URLs?
Thanks,
{
"app": {
"background": {
// Optional
"scripts": [
"js/foam.js",
"js/cab.js",
"config.js",
"background_main.js"]
}
},
"manifest_version": 2,
"name": "LSR7 Schoology Locked Browser",
"version": "0.3",
"default_locale": "en",
"icons": {"128":"img/128.png"},
"permissions": [
"webview",
"power",
"storage",
"videoCapture",
"geolocation",
"pointerLock",
"system.display",
{"fileSystem":["write","retainEntries","directory"]},"accessibilityFeatures.read","accessibilityFeatures.modify"
]
}
*CONFIDENTIALITY NOTICE AND DISCLAIMER: * This e-mail and any
attachments may be confidential and may contain privileged or copyright
information. If you are not the intended recipient, please call (816)
986-1444 and inform us that you have received this message in error.
Please do not copy, distribute or use this e-mail or the information
contained in it for any purpose.
--
You received this message because you are subscribed to the Google Groups
"Chromium-Apps-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an
Visit this group at
https://groups.google.com/a/chromium.org/group/chromium-apps/.
For more options, visit https://groups.google.com/a/chromium.org/d/optout
.

--
CONFIDENTIALITY NOTICE AND DISCLAIMER:  This e-mail and any attachments
may be confidential and may contain privileged or copyright information. 
If you are not the intended recipient, please call [phone] and
inform us that you have received this message in error.   Please do not
copy, distribute or use this e-mail or the information contained in it for
any purpose.

[PhistucK]

I believe you need to use a <webview> element in your "browser" page and in
that page, use the snippet of code (with some small modifications, I guess,
like referencing the actual <webview> and not just an undefined variable
named webview).
You do need to know front end web development (JavaScript, HTML and the
DOM) in order to create Chrome applications and extensions, so basic web
development questions are out of scope for this group (try stackoverflow.com
instead).

☆*PhistucK*


On Fri, Oct 19, 2018 at 9:29 PM Matthew Hughey - Technology <

Post by Matthew Hughey - Technology
I do plan on using webview. I found this sample from Google's developer
webview.request.onBeforeRequest.addListener(
function(details) { return {cancel: true}; },
{urls: ["*://www.evil.com/*"]},
["blocking"]);
But when I add that to my background_main.js file, It returns an error
saying the webview is not defined. Sadly I don't have a lot of experience
with JavaScript, so I'm not sure how or where in my file structure to
define webview. Thoughts?
Thanks.
*--*
*Matthew Hughey*
District Technology Specialist - Lee's Summit R7 School District
301 NE Tudor Rd. / Lee's Summit, MO 64086
816.986.1089 (Office)
---------------------------------------------------------------------------------------------------------------------

Post by PhistucK
I guess that depends on how you implement this application. Are you using
<webview>? If so, I believe it has a JavaScript API for
monitoring/blocking navigation. loadstart
<https://developer.chrome.com/apps/tags/webview#event-loadstart> or
loadcommit
<https://developer.chrome.com/apps/tags/webview#event-loadcommit> events
come to mind.
☆*PhistucK*
On Fri, Oct 19, 2018 at 4:58 PM Matthew Hughey - Technology <

Post by Matthew Hughey - Technology
I am trying to build a "locked down browser" app. Basically it is just a
kiosk app that only goes to one website. I have that setup and working
great. The point of this app is for our students to take tests, so they
cannot use the Internet to find answers to questions.
The issue is that our testing website uses Google SSO. Students find
when they click on any of the additional "create account," "learn more,"
etc. links found on the Google login page, they can eventually click their
way to the Google search page and have unfiltered Internet access.
How can I modify a kiosk packaged app to include specific blacklisted URLs?
Thanks,
{
"app": {
"background": {
// Optional
"scripts": [
"js/foam.js",
"js/cab.js",
"config.js",
"background_main.js"]
}
},
"manifest_version": 2,
"name": "LSR7 Schoology Locked Browser",
"version": "0.3",
"default_locale": "en",
"icons": {"128":"img/128.png"},
"permissions": [
"webview",
"power",
"storage",
"videoCapture",
"geolocation",
"pointerLock",
"system.display",
{"fileSystem":["write","retainEntries","directory"]},"accessibilityFeatures.read","accessibilityFeatures.modify"
]
}
*CONFIDENTIALITY NOTICE AND DISCLAIMER: * This e-mail and any
attachments may be confidential and may contain privileged or copyright
information. If you are not the intended recipient, please call (816)
986-1444 and inform us that you have received this message in error.
Please do not copy, distribute or use this e-mail or the information
contained in it for any purpose.
--
You received this message because you are subscribed to the Google
Groups "Chromium-Apps-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send
Visit this group at
https://groups.google.com/a/chromium.org/group/chromium-apps/.
For more options, visit
https://groups.google.com/a/chromium.org/d/optout.

*CONFIDENTIALITY NOTICE AND DISCLAIMER: * This e-mail and any attachments
may be confidential and may contain privileged or copyright information.
If you are not the intended recipient, please call [phone] and
inform us that you have received this message in error. Please do not
copy, distribute or use this e-mail or the information contained in it for
any purpose.