[Web Payment] Correct request initiator for Android manifest fetch.

Before this patch, Chrome always set Sec-Fetch-Site header to
"cross-origin" when downloading manifests to verify Android payment
apps.

This patch sets the initiator origin for downloading payment method
manifest files and sets that file's origin as the initiator of web app
manifest file download when verifying Android payment apps. These
origins enable setting the correct Sec-Fetch-Site headers in network
request, for example.

In addition, this patch uses org.chromium.url.URI objects in the JNI
interface of PaymentManifestDownloader.java instead of converting to and
from a string.

After this patch, Chrome correctly sets Sec-Fetch-Site header to either
"cross-origin", "same-site", or "same-origin" when downloading manifests
to verify Android payment app.

Bug: 1048201
Change-Id: If256926daa4a9e43733d79c8fd3049cfbd65a5c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2044710
Auto-Submit: Rouslan Solomakhin <rouslan@chromium.org>
Commit-Queue: Brian Sheedy <bsheedy@chromium.org>
Reviewed-by: Brian Sheedy <bsheedy@chromium.org>
Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: Sahel Sharify <sahel@chromium.org>
Cr-Commit-Position: refs/heads/master@{#740352}

chrome/android/BUILD.gn

@@ -381,6 +381,7 @@ android_library("chrome_java") {
     "//ui/base/mojom:mojom_java",
     "//ui/gfx/geometry/mojom:mojom_java",
     "//url:gurl_java",
+    "//url:origin_java",
     "//url/mojom:url_mojom_gurl_java",
   ]
 

chrome/android/java/src/org/chromium/chrome/browser/payments/AndroidPaymentAppFinder.java

@@ -328,7 +328,8 @@ public class AndroidPaymentAppFinder implements ManifestVerifyCallback {
                 mDownloader.initialize(mDelegate.getParams().getWebContents());
             }
 
-            manifestVerifiers.add(new PaymentManifestVerifier(uriMethodName,
+            manifestVerifiers.add(new PaymentManifestVerifier(
+                    mDelegate.getParams().getPaymentRequestSecurityOrigin(), uriMethodName,
                     uriMethodToDefaultAppsMapping.get(uriMethodName),
                     uriMethodToSupportedOriginsMapping.get(uriMethodName), mWebDataService,
                     mDownloader, mParser, mPackageManagerDelegate, this /* callback */));

chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentManifestVerifier.java

@@ -16,6 +16,7 @@ import org.chromium.components.payments.PaymentManifestDownloader.ManifestDownlo
 import org.chromium.components.payments.PaymentManifestParser;
 import org.chromium.components.payments.PaymentManifestParser.ManifestParseCallback;
 import org.chromium.components.payments.WebAppManifestSection;
+import org.chromium.url.Origin;
 import org.chromium.url.URI;
 
 import java.security.MessageDigest;
@@ -108,6 +109,12 @@ public class PaymentManifestVerifier
     private static final String TAG = "PaymentManifest";
     private static final String ALL_ORIGINS_SUPPORTED_INDICATOR = "*";
 
+    /**
+     * The origin of the iframe that invoked the PaymentRequest API. Used by security features like
+     * 'Sec-Fetch-Site' and 'Cross-Origin-Resource-Policy'.
+     */
+    private final Origin mMerchantOrigin;
+
     /**
      * The payment method name that's being verified. The corresponding payment method manifest
      * and default web app manifests will be downloaded, parsed, and cached.
@@ -136,6 +143,9 @@ public class PaymentManifestVerifier
     private final ManifestVerifyCallback mCallback;
     private final MessageDigest mMessageDigest;
 
+    /** The origin of the payment method manifest after all redirects have been followed. */
+    private Origin mPaymentMethodManifestOrigin;
+
     /**
      * The number of web app manifests that have not yet been retrieved from cache or downloaded
      * from the web.
@@ -153,6 +163,7 @@ public class PaymentManifestVerifier
     /**
      * Builds the manifest verifier.
      *
+     * @param merchantOrigin         The origin of the iframe that invoked the PaymentRequest API.
      * @param methodName             The name of the payment method name that apps offer to handle.
      *                               Must be an absolute URI with HTTPS scheme or HTTP localhost.
      * @param defaultApplications    The identifying information for the native Android payment apps
@@ -167,12 +178,14 @@ public class PaymentManifestVerifier
      * @param packageManagerDelegate The package information retriever.
      * @param callback               The callback to be notified of verification result.
      */
-    public PaymentManifestVerifier(URI methodName, @Nullable Set<ResolveInfo> defaultApplications,
-            @Nullable Set<URI> supportedOrigins, PaymentManifestWebDataService webDataService,
-            PaymentManifestDownloader downloader, PaymentManifestParser parser,
-            PackageManagerDelegate packageManagerDelegate, ManifestVerifyCallback callback) {
+    public PaymentManifestVerifier(Origin merchantOrigin, URI methodName,
+            @Nullable Set<ResolveInfo> defaultApplications, @Nullable Set<URI> supportedOrigins,
+            PaymentManifestWebDataService webDataService, PaymentManifestDownloader downloader,
+            PaymentManifestParser parser, PackageManagerDelegate packageManagerDelegate,
+            ManifestVerifyCallback callback) {
         assert methodName.isAbsolute();
 
+        mMerchantOrigin = merchantOrigin;
         mMethodName = methodName;
 
         if (defaultApplications != null) {
@@ -244,7 +257,7 @@ public class PaymentManifestVerifier
         // Try to fetch manifest from the cache first.
         if (!mCache.getPaymentMethodManifest(mMethodName.toString(), this)) {
             mIsManifestCacheStaleOrUnusable = true;
-            mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+            mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
         }
     }
 
@@ -277,7 +290,7 @@ public class PaymentManifestVerifier
             if (appIdentifiers[i] == null) {
                 // The cache is stale. Download the manifest from the web instead.
                 mIsManifestCacheStaleOrUnusable = true;
-                mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+                mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
                 return;
             }
 
@@ -302,7 +315,7 @@ public class PaymentManifestVerifier
                 || (!cachedSupportedOrigins.containsAll(mSupportedOrigins)
                            && !cachedAllOriginsSupported)) {
             mIsManifestCacheStaleOrUnusable = true;
-            mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+            mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
             return;
         }
 
@@ -318,7 +331,7 @@ public class PaymentManifestVerifier
         if (mDefaultApplications.isEmpty()) {
             mCallback.onFinishedVerification();
             // Download and parse manifest to refresh cache.
-            mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+            mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
             return;
         }
 
@@ -327,7 +340,7 @@ public class PaymentManifestVerifier
             if (!mCache.getPaymentWebAppManifest(matchingAppPackageName, this)) {
                 mIsManifestCacheStaleOrUnusable = true;
                 mPendingWebAppManifestsCount = 0;
-                mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+                mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
                 return;
             }
         }
@@ -340,7 +353,7 @@ public class PaymentManifestVerifier
         if (manifest == null || manifest.length == 0) {
             mIsManifestCacheStaleOrUnusable = true;
             mPendingWebAppManifestsCount = 0;
-            mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+            mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
             return;
         }
 
@@ -356,11 +369,15 @@ public class PaymentManifestVerifier
         mCallback.onFinishedVerification();
 
         // Download and parse manifest to refresh cache.
-        mDownloader.downloadPaymentMethodManifest(mMethodName, this);
+        mDownloader.downloadPaymentMethodManifest(mMerchantOrigin, mMethodName, this);
     }
 
     @Override
-    public void onPaymentMethodManifestDownloadSuccess(String content) {
+    public void onPaymentMethodManifestDownloadSuccess(
+            Origin paymentMethodManifestOrigin, String content) {
+        assert mPaymentMethodManifestOrigin
+                == null : "Each verifier downloads exactly one payment method manifest file";
+        mPaymentMethodManifestOrigin = paymentMethodManifestOrigin;
         mParser.parsePaymentMethodManifest(content, this);
     }
 
@@ -403,7 +420,8 @@ public class PaymentManifestVerifier
         for (int i = 0; i < webAppManifestUris.length; i++) {
             if (mAtLeastOneManifestFailedToDownloadOrParse) return;
             assert webAppManifestUris[i] != null;
-            mDownloader.downloadWebAppManifest(webAppManifestUris[i], this);
+            mDownloader.downloadWebAppManifest(
+                    mPaymentMethodManifestOrigin, webAppManifestUris[i], this);
         }
     }
 

chrome/android/javatests/src/org/chromium/chrome/browser/payments/AndroidPaymentAppFinderTest.java

@@ -28,6 +28,7 @@ import org.chromium.content_public.browser.test.util.CriteriaHelper;
 import org.chromium.net.test.EmbeddedTestServer;
 import org.chromium.payments.mojom.PaymentDetailsModifier;
 import org.chromium.payments.mojom.PaymentMethodData;
+import org.chromium.url.Origin;
 import org.chromium.url.URI;
 
 import java.net.URISyntaxException;
@@ -66,14 +67,16 @@ public class AndroidPaymentAppFinderTest
 
         @Override
         public void downloadPaymentMethodManifest(
-                URI methodName, ManifestDownloadCallback callback) {
-            super.downloadPaymentMethodManifest(substituteTestServerUri(methodName), callback);
+                Origin merchantOrigin, URI methodName, ManifestDownloadCallback callback) {
+            super.downloadPaymentMethodManifest(
+                    merchantOrigin, substituteTestServerUri(methodName), callback);
         }
 
         @Override
-        public void downloadWebAppManifest(
+        public void downloadWebAppManifest(Origin paymentMethodManifestOrigin,
                 URI webAppManifestUri, ManifestDownloadCallback callback) {
-            super.downloadWebAppManifest(substituteTestServerUri(webAppManifestUri), callback);
+            super.downloadWebAppManifest(paymentMethodManifestOrigin,
+                    substituteTestServerUri(webAppManifestUri), callback);
         }
 
         private URI substituteTestServerUri(URI uri) {
@@ -127,6 +130,12 @@ public class AndroidPaymentAppFinderTest
         return Collections.unmodifiableMap(new HashMap<String, PaymentDetailsModifier>());
     }
 
+    // PaymentAppFactoryParams implementation.
+    @Override
+    public Origin getPaymentRequestSecurityOrigin() {
+        return PaymentManifestDownloader.createOpaqueOriginForTest();
+    }
+
     // PaymentAppFactoryParams implementation.
     @Override
     public Map<String, PaymentMethodData> getMethodData() {

chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentManifestDownloaderTest.java

@@ -25,6 +25,7 @@ import org.chromium.components.payments.PaymentManifestDownloader.ManifestDownlo
 import org.chromium.content_public.browser.test.util.Criteria;
 import org.chromium.content_public.browser.test.util.CriteriaHelper;
 import org.chromium.net.test.EmbeddedTestServer;
+import org.chromium.url.Origin;
 import org.chromium.url.URI;
 
 /** An integration test for the payment manifest downloader. */
@@ -61,6 +62,7 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
             + "}\n";
 
     private final PaymentManifestDownloader mDownloader = new PaymentManifestDownloader();
+    private Origin mTestOrigin;
     private EmbeddedTestServer mServer;
     private boolean mDownloadComplete;
     private boolean mDownloadPaymentMethodManifestSuccess;
@@ -71,7 +73,8 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
     private String mWebAppManifest;
 
     @Override
-    public void onPaymentMethodManifestDownloadSuccess(String content) {
+    public void onPaymentMethodManifestDownloadSuccess(
+            Origin paymentMethodManifestOrigin, String content) {
         mDownloadComplete = true;
         mDownloadPaymentMethodManifestSuccess = true;
         mPaymentMethodManifest = content;
@@ -97,6 +100,7 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
         mServer = EmbeddedTestServer.createAndStartServer(InstrumentationRegistry.getContext());
         mRule.runOnUiThread((Runnable) () -> {
             mDownloader.initialize(mRule.getActivity().getCurrentWebContents());
+            mTestOrigin = PaymentManifestDownloader.createOpaqueOriginForTest();
         });
         mDownloadComplete = false;
         mDownloadPaymentMethodManifestSuccess = false;
@@ -118,8 +122,9 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
     public void testDownloadWebAppManifest() throws Throwable {
         final URI uri =
                 new URI(mServer.getURL("/components/test/data/payments/bobpay.com/app.json"));
-        mRule.runOnUiThread((Runnable) () -> mDownloader.downloadWebAppManifest(uri,
-                PaymentManifestDownloaderTest.this));
+        mRule.runOnUiThread((Runnable) ()
+                                    -> mDownloader.downloadWebAppManifest(
+                                            mTestOrigin, uri, PaymentManifestDownloaderTest.this));
         CriteriaHelper.pollInstrumentationThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -136,8 +141,9 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
     @Feature({"Payments"})
     public void testUnableToDownloadWebAppManifest() throws Throwable {
         final URI uri = new URI(mServer.getURL("/no-such-app.json"));
-        mRule.runOnUiThread((Runnable) () -> mDownloader.downloadWebAppManifest(uri,
-                PaymentManifestDownloaderTest.this));
+        mRule.runOnUiThread((Runnable) ()
+                                    -> mDownloader.downloadWebAppManifest(
+                                            mTestOrigin, uri, PaymentManifestDownloaderTest.this));
         CriteriaHelper.pollInstrumentationThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -154,8 +160,9 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
     @Feature({"Payments"})
     public void testDownloadPaymentMethodManifest() throws Throwable {
         final URI uri = new URI(mServer.getURL("/components/test/data/payments/bobpay.com/webpay"));
-        mRule.runOnUiThread((Runnable) () -> mDownloader.downloadPaymentMethodManifest(uri,
-                PaymentManifestDownloaderTest.this));
+        mRule.runOnUiThread((Runnable) ()
+                                    -> mDownloader.downloadPaymentMethodManifest(
+                                            mTestOrigin, uri, PaymentManifestDownloaderTest.this));
         CriteriaHelper.pollInstrumentationThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -172,8 +179,9 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
     @Feature({"Payments"})
     public void testUnableToDownloadPaymentMethodManifest() throws Throwable {
         final URI uri = new URI(mServer.getURL("/no-such-payment-method-name"));
-        mRule.runOnUiThread((Runnable) () -> mDownloader.downloadPaymentMethodManifest(uri,
-                PaymentManifestDownloaderTest.this));
+        mRule.runOnUiThread((Runnable) ()
+                                    -> mDownloader.downloadPaymentMethodManifest(
+                                            mTestOrigin, uri, PaymentManifestDownloaderTest.this));
         CriteriaHelper.pollInstrumentationThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -199,11 +207,13 @@ public class PaymentManifestDownloaderTest implements ManifestDownloadCallback {
                 new URI(mServer.getURL("/components/test/data/payments/bobpay.com/app.json"));
         mRule.runOnUiThread((Runnable) () -> {
             mDownloader.downloadPaymentMethodManifest(
-                    paymentMethodUri1, PaymentManifestDownloaderTest.this);
+                    mTestOrigin, paymentMethodUri1, PaymentManifestDownloaderTest.this);
             mDownloader.downloadPaymentMethodManifest(
-                    paymentMethodUri2, PaymentManifestDownloaderTest.this);
-            mDownloader.downloadWebAppManifest(webAppUri1, PaymentManifestDownloaderTest.this);
-            mDownloader.downloadWebAppManifest(webAppUri2, PaymentManifestDownloaderTest.this);
+                    mTestOrigin, paymentMethodUri2, PaymentManifestDownloaderTest.this);
+            mDownloader.downloadWebAppManifest(
+                    mTestOrigin, webAppUri1, PaymentManifestDownloaderTest.this);
+            mDownloader.downloadWebAppManifest(
+                    mTestOrigin, webAppUri2, PaymentManifestDownloaderTest.this);
         });
         CriteriaHelper.pollInstrumentationThread(new Criteria() {
             @Override

chrome/android/native_java_unittests/src/org/chromium/chrome/browser/payments/AndroidPaymentAppFinderUnitTest.java

@@ -26,6 +26,7 @@ import org.chromium.components.payments.WebAppManifestSection;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.payments.mojom.PaymentDetailsModifier;
 import org.chromium.payments.mojom.PaymentMethodData;
+import org.chromium.url.Origin;
 import org.chromium.url.URI;
 
 import java.net.URISyntaxException;
@@ -360,12 +361,15 @@ public class AndroidPaymentAppFinderUnitTest {
             public void initialize(WebContents webContents) {}
 
             @Override
-            public void downloadPaymentMethodManifest(URI uri, ManifestDownloadCallback callback) {
-                callback.onPaymentMethodManifestDownloadSuccess("some content here");
+            public void downloadPaymentMethodManifest(
+                    Origin merchantOrigin, URI uri, ManifestDownloadCallback callback) {
+                callback.onPaymentMethodManifestDownloadSuccess(
+                        PaymentManifestDownloader.createOpaqueOriginForTest(), "some content here");
             }
 
             @Override
-            public void downloadWebAppManifest(URI uri, ManifestDownloadCallback callback) {
+            public void downloadWebAppManifest(Origin paynentMethodManifestOrigin, URI uri,
+                    ManifestDownloadCallback callback) {
                 callback.onWebAppManifestDownloadSuccess("some content here");
             }
 

components/payments/content/android/BUILD.gn

@@ -32,6 +32,8 @@ static_library("android") {
     "//components/payments/core",
     "//content/public/browser",
     "//net",
+    "//url:gurl_android",
+    "//url:origin_android",
   ]
 }
 
@@ -68,6 +70,7 @@ android_library("java") {
     "//mojo/public/java:bindings_java",
     "//third_party/blink/public/mojom:android_mojo_bindings_java",
     "//url:gurl_java",
+    "//url:origin_java",
   ]
 }
 

components/payments/content/android/java/src/org/chromium/components/payments/PaymentManifestDownloader.java

@@ -4,11 +4,14 @@
 
 package org.chromium.components.payments;
 
+import androidx.annotation.VisibleForTesting;
+
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.NativeMethods;
 import org.chromium.content_public.browser.WebContents;
+import org.chromium.url.Origin;
 import org.chromium.url.URI;
 
 /**
@@ -22,10 +25,13 @@ public class PaymentManifestDownloader {
         /**
          * Called on successful download of a payment method manifest.
          *
-         * @param content The successfully downloaded payment method manifest.
+         * @param paymentMethodManifestOrigin The origin of the payment method manifest after all
+         *                                    redirects have been followed.
+         * @param content                     The successfully downloaded payment method manifest.
          */
         @CalledByNative("ManifestDownloadCallback")
-        void onPaymentMethodManifestDownloadSuccess(String content);
+        void onPaymentMethodManifestDownloadSuccess(
+                Origin paymentMethodManifestOrigin, String content);
 
         /**
          * Called on successful download of a web app manifest.
@@ -67,27 +73,35 @@ public class PaymentManifestDownloader {
     /**
      * Downloads the payment method manifest file asynchronously.
      *
-     * @param methodName The payment method name that is a URI with HTTPS scheme.
-     * @param callback   The callback to invoke when finished downloading.
+     * @param merchantOrigin The origin of the iframe that invoked the PaymentRequest API.
+     * @param methodName     The payment method name that is a URI with HTTPS scheme.
+     * @param callback       The callback to invoke when finished downloading.
      */
-    public void downloadPaymentMethodManifest(URI methodName, ManifestDownloadCallback callback) {
+    public void downloadPaymentMethodManifest(
+            Origin merchantOrigin, URI methodName, ManifestDownloadCallback callback) {
         ThreadUtils.assertOnUiThread();
         assert mNativeObject != 0;
-        PaymentManifestDownloaderJni.get().downloadPaymentMethodManifest(
-                mNativeObject, PaymentManifestDownloader.this, methodName, callback);
+        assert merchantOrigin != null;
+        PaymentManifestDownloaderJni.get().downloadPaymentMethodManifest(mNativeObject,
+                PaymentManifestDownloader.this, merchantOrigin, methodName, callback);
     }
 
     /**
      * Downloads the web app manifest file asynchronously.
      *
-     * @param webAppManifestUri The web app manifest URI with HTTPS scheme.
-     * @param callback          The callback to invoke when finished downloading.
+     * @param paymentMethodManifestOrigin The origin of the payment method manifest that is pointing
+     *                                    to this web app manifest.
+     * @param webAppManifestUri           The web app manifest URI with HTTPS scheme.
+     * @param callback                    The callback to invoke when finished downloading.
      */
-    public void downloadWebAppManifest(URI webAppManifestUri, ManifestDownloadCallback callback) {
+    public void downloadWebAppManifest(Origin paymentMethodManifestOrigin, URI webAppManifestUri,
+            ManifestDownloadCallback callback) {
         ThreadUtils.assertOnUiThread();
         assert mNativeObject != 0;
-        PaymentManifestDownloaderJni.get().downloadWebAppManifest(
-                mNativeObject, PaymentManifestDownloader.this, webAppManifestUri, callback);
+        assert paymentMethodManifestOrigin != null;
+        PaymentManifestDownloaderJni.get().downloadWebAppManifest(mNativeObject,
+                PaymentManifestDownloader.this, paymentMethodManifestOrigin, webAppManifestUri,
+                callback);
     }
 
     /** Destroys the native downloader. */
@@ -98,20 +112,22 @@ public class PaymentManifestDownloader {
         mNativeObject = 0;
     }
 
-    @CalledByNative
-    private static String getUriString(URI methodName) {
-        return methodName.toString();
+    /** @return An opaque origin to be used in tests. */
+    @VisibleForTesting
+    public static Origin createOpaqueOriginForTest() {
+        return PaymentManifestDownloaderJni.get().createOpaqueOriginForTest();
     }
 
     @NativeMethods
     interface Natives {
         long init(WebContents webContents);
         void downloadPaymentMethodManifest(long nativePaymentManifestDownloaderAndroid,
-                PaymentManifestDownloader caller, URI methodName,
+                PaymentManifestDownloader caller, Origin merchantOrigin, URI methodName,
                 ManifestDownloadCallback callback);
         void downloadWebAppManifest(long nativePaymentManifestDownloaderAndroid,
-                PaymentManifestDownloader caller, URI webAppManifestUri,
-                ManifestDownloadCallback callback);
+                PaymentManifestDownloader caller, Origin paymentMethodManifestOrigin,
+                URI webAppManifestUri, ManifestDownloadCallback callback);
         void destroy(long nativePaymentManifestDownloaderAndroid, PaymentManifestDownloader caller);
+        Origin createOpaqueOriginForTest();
     }
 }

components/payments/content/android/payment_manifest_downloader_android.cc

@@ -15,6 +15,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "url/android/gurl_android.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -41,6 +42,7 @@ class DownloadCallback {
     } else {
       Java_ManifestDownloadCallback_onPaymentMethodManifestDownloadSuccess(
           env, jcallback_,
+          url::Origin::Create(url_after_redirects).CreateJavaObject(),
           base::android::ConvertUTF8ToJavaString(env, content));
     }
   }
@@ -79,12 +81,12 @@ PaymentManifestDownloaderAndroid::~PaymentManifestDownloaderAndroid() {}
 void PaymentManifestDownloaderAndroid::DownloadPaymentMethodManifest(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& jcaller,
+    const base::android::JavaParamRef<jobject>& jmerchant_origin,
     const base::android::JavaParamRef<jobject>& juri,
     const base::android::JavaParamRef<jobject>& jcallback) {
   downloader_.DownloadPaymentMethodManifest(
-      url::Origin(),  // TODO(rouslan): Use actual origin.
-      GURL(base::android::ConvertJavaStringToUTF8(
-          env, Java_PaymentManifestDownloader_getUriString(env, juri))),
+      url::Origin::FromJavaObject(jmerchant_origin),
+      *url::GURLAndroid::ToNativeGURL(env, juri),
       base::BindOnce(&DownloadCallback::OnPaymentMethodManifestDownload,
                      std::make_unique<DownloadCallback>(jcallback)));
 }
@@ -92,12 +94,12 @@ void PaymentManifestDownloaderAndroid::DownloadPaymentMethodManifest(
 void PaymentManifestDownloaderAndroid::DownloadWebAppManifest(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& jcaller,
+    const base::android::JavaParamRef<jobject>& jpayment_method_manifest_origin,
     const base::android::JavaParamRef<jobject>& juri,
     const base::android::JavaParamRef<jobject>& jcallback) {
   downloader_.DownloadWebAppManifest(
-      url::Origin(),  // TODO(rouslan): Use actual origin.
-      GURL(base::android::ConvertJavaStringToUTF8(
-          env, Java_PaymentManifestDownloader_getUriString(env, juri))),
+      url::Origin::FromJavaObject(jpayment_method_manifest_origin),
+      *url::GURLAndroid::ToNativeGURL(env, juri),
       base::BindOnce(&DownloadCallback::OnWebAppManifestDownload,
                      std::make_unique<DownloadCallback>(jcallback)));
 }
@@ -125,4 +127,10 @@ static jlong JNI_PaymentManifestDownloader_Init(
           ->GetURLLoaderFactoryForBrowserProcess()));
 }
 
+// Static free function declared and called directly from java.
+static base::android::ScopedJavaLocalRef<jobject>
+JNI_PaymentManifestDownloader_CreateOpaqueOriginForTest(JNIEnv* unused_env) {
+  return url::Origin().CreateJavaObject();
+}
+
 }  // namespace payments

components/payments/content/android/payment_manifest_downloader_android.h

@@ -32,12 +32,15 @@ class PaymentManifestDownloaderAndroid {
   void DownloadPaymentMethodManifest(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& jcaller,
+      const base::android::JavaParamRef<jobject>& jmerchant_origin,
       const base::android::JavaParamRef<jobject>& juri,
       const base::android::JavaParamRef<jobject>& jcallback);
 
   void DownloadWebAppManifest(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& jcaller,
+      const base::android::JavaParamRef<jobject>&
+          jpayment_method_manifest_origin,
       const base::android::JavaParamRef<jobject>& juri,
       const base::android::JavaParamRef<jobject>& jcallback);