VPAID Ads stopped working in Chrome 66

[Konstantine Rybnikov]

Hi. I just found that our VPAID implementation stopped working in Chrome, I've checked older versions in a VM and can confirm that it works in Chrome 65, but does not in 66 and 67.

To test, use this tag https://a.thoughtleadr.com/vpaid-20/56e21636-ac41-4875-8789-970848828235/vast.xml in the Google HTML5 VAST Inspector https://developers.google.com/interactive-media-ads/docs/sdks/html5/vastinspector

Networking panel is now showing a "failed to load" message on a loader15.html (from tpc.googlesyndication.com), while still showing that our vpaid-20.js is loading somehow, but that one is also showing the "failed to load" message. Console shows the CORB messages now (they were declared to become in effect starting from version 67, but I see that 66 doesn't work as well https://www.chromestatus.com/feature/5629709824032768 ).

I'm not sure I understand how CORB is related here and if it's something that needs to be fixed in IMA SDK itself or not.

Help is very much appreciated!

[Konstantine Rybnikov]

Forgot to attach some screenshots in case they'll be helpful:

[Konstantine Rybnikov]

Due to this video explaining CORB and Spectre/Meltdown effects on Chrome https://www.youtube.com/watch?time_continue=1546&v=dBuykrdhK-A , html isn't loaded because:

- it has HTML type

- it has X-Content-Type-Options: nosniff

- it has no explicit CORS

Please see video from https://youtu.be/dBuykrdhK-A?t=25m46s (or a bit earlier for context)

How can I contact an owner at Google to set proper CORS headers for the https://tpc.googlesyndication.com/pagead/js/loader15.html page?

I believe the domain i

On Wednesday, June 6, 2018 at 8:32:03 PM UTC+3, Konstantine Rybnikov wrote:

[ima-sdk-adv...@google.com]

Hi,

Thank you for reaching out to support. I had no issues playing the linked ad tag in our Video Suite Inspector. If you continue to have issues, I'd suggest reaching out to your creative provider. We generally can't support issues with VPAID creatives as they are often caused by the VPAID implementation rather than our SDK. This is especially true if you're running into a CORS header error. The creative provider will need to resolve that type of issue.

Regards,

Chris Feldman
IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

--
You received this message because you are subscribed to the Google Groups "Interactive Media Ads SDK" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ima-sdk+unsubscribe@googlegroups.com.
To post to this group, send email to ima...@googlegroups.com.
Visit this group at https://groups.google.com/group/ima-sdk.
For more options, visit https://groups.google.com/d/optout.

[Konstantine Rybnikov]

Hi,

Thank you for checking this out. May I ask if your Chrome was of version 67 or earlier? I just re-checked on my macOS machine, and I can confirm I didn't see the CORB errors on version 66, but I could see them in the latest version 67.

In this case, we are the creative provider, and we use the Amazon S3 to store the creatives (behind MaxCDN) and have substantial control over all the headers, so you can think of this as a test page with static content available for debugging. Please keep in mind that this is a CORB, not CORS error, we are setting all the CORS headers correctly and the ad was working successfully for a substantial amount of time.

I will continue looking into ways to extend our VPAID implementation to provide more details and I understand that it's not your job to do that, but I would appreciate if you would look into the problems which are not specific to the implementation and are related to a content served on Google's domains.

Thank you!

[ima-sdk-adv...@google.com]

Hi Konstantine,

Thank you for following up. If the issue is present in Chrome 66 but not Chrome 67, it was most likely a Chrome issue that has now been resolved. Regardless, even when I test on Chrome 66 specifically, I'm not getting a CORB error, just a 901 for VPAID error. Are you still seeing the CORB error with that tag? 

Regards,

Chris Feldman
IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Konstantine Rybnikov]

Hi Chris,

Thank you for continuing the investigation. I just created a fresh Windows VM and cloned it, having Chrome 65 with disabled updates in one and Chrome 67 (latest) in another. I can confirm Chrome 65 does work, while 67 does not, showing the CORB errors from Google's resource mentioned before. Please see screenshots showing the non-working latest Chrome and then a working one (in the middle of displaying the ad).

I also confirmed on my Macbook Pro that latest Chrome 67 is showing the same behavior. Lastly, my Desktop with Ubuntu shows the same result. The error text written in a text box is: (9:11:37 PM) Ad error: AdError 901: An unexpected error occurred within the VPAID creative. Refer to the inner error for more info.

Attaching the screenshots. Windows VM with Chrome 67 Failure:

Network panel of a failure. This is our resource but the same is true for a one which loads it (from tpc.googlesyndication.com):

Chrome 65 working:

Error on macOS:

Please tell if I can provide any additional information to you. Thank you!

[ima-sdk-adv...@google.com]

Hi,

I have a clean console on every platform and Chrome version that I've tested with. I've tried Chrome 65, 66, and 67 on Windows and Mac. I'm not sure where the disconnect is between your setup and mine. Is it possible we're being served slightly different resources based on our respective locations? I'm located in New York. If you continue to have issues, it may be helpful for you to share a Charles log. That would be the next step from our perspective.

Regards,

Chris Feldman
IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Dean]

Hi Chris,

We are running into this as well starting at the same time and under the same conditions as Konstantine reported. We are getting the following error after running VPAID error free since the time we first started on the IMA3 SDK. The error message we are getting is:

(4:34:44 PM) Ad error: AdError 901: An unexpected error occurred within the VPAID creative. Refer to the inner error for more info. Caused by: Error: Error: Ad blocked

Let me know if I can provide additional information or if you guys have already figured this out.

Thanks,

Dean

[Dean]

I should have mentioned that I got the same error running the tag in your Validator. However, several times now I have saved the ad tags that fail both on our system and the Validator and when I've retested them later they've worked so I wrote this off to faulty ads that had been fixed (although this has been rare in the past). I'm reporting this now after seeing Konstantine's post just in case we can provide additional information for you. Let me know and I will capture these when they are logged and send you the details.

Thanks,

Dean

[ima-sdk-adv...@google.com]

Hi Dean,

Are you also getting the CORB error? If you have an ad tag you can share, I'll take a look. That being said, AdError 901 usually is caused by faulty ads. If you've not already done so, I would suggest reaching out to your creative provider as well.

Regards,
Chris Feldman
IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Konstantine Rybnikov]

Hi Chris, once again huge thanks for the assistance and testing.

Indeed, I am located in Kyiv, Ukraine, that might be the reason of our differences, but I just installed a VPN (from Privateinternetaccess), connected to the New York City, and still see no difference. Please see a screenshot showing "whatismyip" confirming the location.

Here is the Charlesproxy log for you: https://drive.google.com/file/d/1GuJHyNflYfxvoLxsJSDIHGzeChYyPxQA/view?usp=sharing (alternative link https://send.firefox.com/share/b280610b40 )

May I ask few additional questions regarding the IMA SDK and CORB in question:

- how is our vpaid-20.js loaded for you? For me, it's done from a page https://tpc.googlesyndication.com/pagead/js/loader15.html?https://cdn.thoughtleadr.com/vpaid-20.js  I would assume it's done differently (thus not producing the CORB error)

- can you check non-minified sources of IMA SDK to find the logic involving the domain "tpc.googlesyndication.com"? I couldn't find one in the minified version, but haven't tried too hard yet with a debugger (will do later)

Anyways, help is very much appreciated. Thank you!

[Konstantine Rybnikov]

Chris, a follow-up from me. I could see the ad not working in a Linux VM without CORB errors for some reason. Digging further, I've found that even with the CORB errors on my main machine, I would still be able to dig the inner error, and it's not the CORB one.

The inner error looks like this:

1. innerError:
1. errorCode:1205
2. errorMessage:"The browser prevented playback initiated without user interaction."
3. type:"adPlayError"

So, few things are still unclear:

- why does the ad work for you without problems

- how would I properly debug the true cause of this problem

Any suggestions are appreciated!

[ima-sdk-adv...@google.com]

Hi Konstantine,

The majority of your Charles log is unintelligible. Can you please enable SSL proxying and record another log?

Also, if your ad is failing with a 1205, it's possible that the creative isn't able to get the user gesture from the client. Can you try using VPAID mode INSECURE? You creative may need access to the DOM to function properly.

Regards,

Chris Feldman
IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Konstantine Rybnikov]

Hi Chris,

Sorry, I have now enabled the SSL proxying in Charles and installed the root certificate properly. Here's the log:

https://drive.google.com/file/d/1pxOACUTSAjtedZRBkww4cE1A3mda1vf1/view?usp=sharing (alternatively: https://www.dropbox.com/s/a7rd4byi6gt5mvu/chrome-67-corb-charles-sslenabled.chls?dl=0 )

I will try the INSECURE mode tomorrow, thank you for the suggestion, but it would still be very nice to understand the root cause of a non-working tag specifically in Chrome 67 (which I'll also try to find out).

Thank you.

[ima-sdk-adv...@google.com]

Hi Konstantine,

With the tag from your Charles log, I was finally able to see CORB errors in my console. However, the errors that I'm receiving should not be fatal. The resources that I'm seeing fail to load are related to tracking and should not be fatal.

I also dug into your VPAID tag a bit. Though the code is obfuscated, there are references in the VPAID source that suggest the ad is loading it's own implementation of the IMA SDK in order to play a standard VAST tag. Our SDK does not support doing this, as it is redundant and known to cause problems. If you're already using IMA, I would suggest loading your ad tag directly. Alternatively, you can reach out to your creative provider for support as they may be able to fix the issue with their tag.

Regards,

Chris Feldman

IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Networking panel is now showing a "failed to load" message on a loader15.html (from tpc.googlesyndication.com), while still showing that our vpaid-20.js is loading somehow, but that one is also showing the "failed to load" message. Console shows the CORB messages now (they were declared to become in effect starting from version 67, but I see that 66 doesn&

[Konstantine Rybnikov]

Chris,

Once again thank you for following up with the problem. It is indeed not related to CORB.

I've made two things:

- I've rebuilt the non-minified version of our code to reproduce the issue

- I've also built the smallest possible implementation (or near that) which would show the issue

I've also added a better error reporting for the inner error in the minimal version. It's now clear that the error is: "The browser prevented playback initiated without user interaction.", which is probably not the "real" cause on the desktop browser.

The JS code for the minimal version can be seen here: https://adserver-develop.staging.thoughtleadr.com/static/vast-mocks/vpaid-client-minimal.js

The JS for the non-minified version of our code: https://adserver-develop.staging.thoughtleadr.com/static/vast-mocks/vpaid-client-tracking2.js

Tag for the minimal JS: https://adserver-develop.staging.thoughtleadr.com/static-cors/vast-mocks/vpaid-kr-minimal.xml

Tag for the non-minified one: https://adserver-develop.staging.thoughtleadr.com/static/vast-mocks/vpaid-kr-tracking2.xml

As previously, everything works in Chrome 65 under Windows, but doesn't work in Chrome 67. I re-checked in VMs, also checked under the New York VPN.

Thank you very much for looking into this! I am happy to provide any additional info, I'm also happy to do more work in debugging, but it's pretty hard to do without a non-minified IMA SDK.

[ima-sdk-adv...@google.com]

Hi Konstantine,

Thank you for sharing the additional information. Chris is out of office today and let me assist you on his behalf. 

I've tested your Ad Tag and it looks like your creative needs a friendly iFrame to render out as I was able to load ads with VPAID Insecure mode. You can either contact your creative provider to update this or use Insecure mode when making the AdRequest.

Let me know if you have any other questions.

Regards,

Deepika Uragayala

IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Konstantine Rybnikov]

Hi Deepika, thanks for following up.

I don't quite see how this is related to the VPAID Insecure Mode, since we don't use VPAID creative (we are serving the ads as VPAID, which itself uses the IMA SDK to render a VAST ad).

Nevertheless, I've added the INSECURE mode setting to both tags, and they still give the "The browser prevented playback initiated without user interaction" error.

The tags have the same address:

Tag for the minimal JS: https://adserver-develop.staging.thoughtleadr.com/static-cors/vast-mocks/vpaid-kr-minimal.xml

Tag for the non-minified one: https://adserver-develop.staging.thoughtleadr.com/static/vast-mocks/vpaid-kr-tracking2.xml

Both work in Chrome 65 but fail in 67.

Screenshot with the error seen:

I am happy to assist in any way that'd be helpful, even happy to have a call and provide a TeamViewer access to the Windows VM if needed.

I should also not that this creative is a test creative, thus you can say that we are the creative provider and are able to control every bit of the creative delivery. If changing something is needed there -- I am able to do so.

Thank you!

[ima-sdk-adv...@google.com]

 Hi Konstantine,

We would be able to happily assist you only via this forum. We don't usually support loading IMA within a VPAID ad. If you are having trouble with these creatives we would suggest that you load your creatives directly to render a VAST Ad.

Regards,

Deepika Uragayala

IMA SDK Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Also find us on our blog and Google+ page:
    http://googleadsdeveloper.blogspot.com
    https://plus.google.com/115658573333388777174/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~