Browser Support Deprecated

[vicatcu]

I know there are other issues "tracking" this in the repo, but I wanted to create a new one to mark the fact that this is no longer theoretical and hopefully give it some renewed attention. I thought maybe Google was bluffing based on the lack of urgency here, but that there's no denying the impact is real, maybe we can do something about it?

Cross-reference #124, #163, #220, #231, #258

[geoffreymina13]

@vicatcu what version of the module are you using? We have 3.2.0 and haven't seen any impact yet. Not even getting warnings in the console when you sign in on web.

I do believe there is another change in the near future which may render this plugin inoperable, but that date appears to be July 24, 2023.

_

Hello Google Developer,

We're writing to let you know that we detected the use of an embedded webview in requests to Google's OAuth 2.0 authorization endpoint in the past 120 days associated with one or more of your OAuth client IDs listed in this email.

Any affected authorization endpoint requests will be blocked with a disallowed_useragent error starting July 24, 2023. Affected requests to our authorization endpoint will display a user-facing warning message starting in May until July 24, 2023.

What do you need to know?
Embedded webview libraries are highly customizable, which can expose Google's login and account authorization pages to potential "man-in-the-middle" attacks. Google's OAuth 2.0 "Use secure browsers" policy helps us protect users from these and other types of attacks.

Examples of affected embedded webview libraries include android.webkit.WebView on Android and WKWebView on iOS or macOS.

_

[vicatcu]

Maybe this was just a strange coincidence. Today it's working again. I didn't change a thing...

[AlvinTCH]

I don't think this plugin is affected by the web view ban as we are using native methods for signing in. Then again I might be wrong

[geoffreymina13]

I don't think this plugin is affected by the web view ban as we are using native methods for signing in. Then again I might be wrong

Thanks, @AlvinTCH - That's what I thought as well... This is the only plugin we use on our mobile apps for Google OAuth - and I'm not sure what would trigger that message from Google if this wasn't related.

[Mehedi50200]

I am having this issue for 2+ weeks. It seems it happened because google dont let you use web client token (serverClientId) to login in with android anymore due to security reason.
Anyway I tried to use androidClientId which what is required for android app for google but then this plugin run into :

{
code: "10",
message: "Something went wrong"
}
which was also the case previously but if we used the webtoken it was working both web and mobile devices but due to google new policy it wont work other than the android specific key.

Please Make this issue a priority.

lots of existing user are dropping due this policy and my use of this plugin. Unfortunately I did not find other plugin replace. Any suggestion or package suggestion?

[AlvinTCH]

@Mehedi50200 I am not facing the same issue despite using this package for production and I doubt that the problem in your app is due to the usage of web client ID in your app. If you refer to this documentation on google sign in for Android (https://developers.google.com/identity/sign-in/android/start), it will ask you to put the "server_client_id" (which in our case, it's the web client id), inside the app instead of the android client id as well.

Google is famous for giving bad code errors which do not accurately describe the problem and I also found myself tearing my head over code 10 when trying to set this up initially. But the code 10 I encountered is usually due to the wrong set up of my SHA-1 keys for the google app. Do check your SHA-1 configuration, on whether you are using the right SHA-1 where there is 1 SHA-1 for the google play if you sign your app using google play, and another in your android studio. Both of these needs to be setup inside the cloud console.

I also do recommend using firebase to set this up as the UI is less confusing and makes things easier to be set up properly. You can use firebase to set up the configuration without using any firebase services

Do refer to this thread and try out the solutions
googlesamples/google-services#360

[Mehedi50200]

@Mehedi50200 I am not facing the same issue despite using this package for production and I doubt that the problem in your app is due to the usage of web client ID in your app. If you refer to this documentation on google sign in for Android (https://developers.google.com/identity/sign-in/android/start), it will ask you to put the "server_client_id" (which in our case, it's the web client id), inside the app instead of the android client id as well.

Google is famous for giving bad code errors which do not accurately describe the problem and I also found myself tearing my head over code 10 when trying to set this up initially. But the code 10 I encountered is usually due to the wrong set up of my SHA-1 keys for the google app. Do check your SHA-1 configuration, on whether you are using the right SHA-1 where there is 1 SHA-1 for the google play if you sign your app using google play, and another in your android studio. Both of these needs to be setup inside the cloud console.

I also do recommend using firebase to set this up as the UI is less confusing and makes things easier to be set up properly. You can use firebase to set up the configuration without using any firebase services

Do refer to this thread and try out the solutions googlesamples/google-services#360

Thanks for the reply. I found out the issue not unfortunately it is bit tricky to explain and also true to my original post but nothing to do with this package. If I use this package individually it works fine with server_client_id. which I was doing previously and it works. but the error occurs when using along with ngFire (firebase).

so the problem is firebase auth dont support the server_client_id anymore when using it from mobile but works fine in web deployment of ionic+ angular . Thank you.