invalid_request Invalid parameter value for approval_prompt: 'auto' is not valid

[garymg18]

Environment details

• OS: docker (Debian)
• PHP version:

php -v
PHP 7.3.16 (cli) (built: Mar 31 2020 18:48:01) ( NTS )

• Package name and version: https://www.mediawiki.org/wiki/Extension:GoogleLogin

Hello, I've a problem with GoogleLogin Extension for mediawiki which is using Your google-api-php-client. From today (yesterday there was no problem) we're getting this error from Google:

Authorization Error
Error 400: invalid_request
Invalid parameter value for approval_prompt: 'true' is not valid

When I changed the value from 'true' to force in Client.php (Client.php#L128) file it started to work. But is this value OK? Maybe this is some kind of bug and should be fixed in other way?

Thank You for Your answer

Best Regards,
Marcin

[kamyweb]

The same on some our oauth applications
Environment details
OS: Amazon Linux/Docker (php:5.6-fpm)
PHP version:

php -v
PHP 5.6.40 (cli) (built: Jan 14 2019 21:32:25) 
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Xdebug v2.5.5, Copyright (c) 2002-2017, by Derick Rethans

Package:
"google/apiclient": "^2.1",
but also with
"google/apiclient": "^2.4",

Authorization Error
Errore 400: invalid_request
Invalid parameter value for approval_prompt: 'auto' is not valid

also try with:
$client->setApprovalPrompt("consent");
with similar error

Authorization Error
Errore 400: invalid_request
Invalid parameter value for approval_prompt: 'consent' is not valid

[inogo]

Please use setPrompt method:
$google->setPrompt('consent');

More details in #1795

[kamyweb]

It works, but I don't undestand why the same code yesterday works correctly...
Is there any changes on google api specs?

[hugovk]

Yes, looks like a change on the Google side, this is affecting many sites (eg. Vimeo) and auth libraries:

• The error is shown after trying to open a link with 'approval_prompt' = auto thephpleague/oauth2-client#831
• Google approval_prompt enforcement is breaking login thephpleague/oauth2-google#87
• Google oauth - approval_prompt: "auto" not a valid parameter value python-social-auth/social-app-django#248
• approval_prompt: 'auto' is not valid MarkEdmondson1234/googleAuthR#177
• Google OAuth does not support approval_prompt: auto hwi/HWIOAuthBundle#1622

Fix is to remove the approval_prompt=auto parameter or replace it with prompt= or approval_prompt=force

https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters

For example:

• https://www.drupal.org/project/social_auth_google/issues/3129494

[abmcr]

Please use setPrompt method:
$google->setPrompt('consent');

More details in #1795

This solve the problem
Thank you

[bshaffer]

Thank you everyone, great dialog. Thanks @inogo and @hugovk for chiming in. Im closing this issue but please comment or continue dialog if I missed anything.

[kamyweb]

@bshaffer don't you think is required to change the default value of Prompt from 'auto' to 'none' or empty as documentated on this site https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters ?

[jkanape]

I think default value of 'prompt' is empty string already:
https://github.com/googleapis/google-api-php-client/blob/master/src/Google/Client.php#L122

But maybe 'approval_prompt' should be changed? (even Google seems to accept 'auto' again)

[hugovk]

Looks like Google have now fixed it, but approval_prompt isn't in the docs so I believe it probably makes sense to change it. We're keeping the change in our library.

[pranshukamalanup]

https://accounts.google.com/signin/oauth/error?authError=Cg9pbnZhbGlkX3JlcXVlc3QSPEludmFsaWQgcGFyYW1ldGVyIHZhbHVlIGZvciBwcm9tcHQ6IEludmFsaWQgcHJvbXB0OiBjb25zZW50Oxo3aHR0cHM6Ly9kZXZlbG9wZXJzLmdvb2dsZS5jb20vaWRlbnRpdHkvcHJvdG9jb2xzL29hdXRoMiCQAw%3D%3D&client_id=83644758924-ckej0ttfsr7umfjj9a8shno24qd1u953.apps.googleusercontent.com

Error 400: invalid_request
Invalid parameter value for prompt: Invalid prompt: consent;

[TheCrowned]

@bshaffer This page still recommends setApprovalPrompt('consent'), which results in a bad request:
https://developers.google.com/identity/protocols/oauth2/web-server