We are migrating from deprecated Google Sign-in (basically gapi.auth and gapi.auth2 methods) into the new Google identity services (google.accounts.oauth2). More info here
We are using the authorization solely for Google picker. The problem is, beforehand (it seems) the library didn't return access_token in their gapi.auth.authorize, which was an indication that something wrong is going on and we've displayed "3rd party cookies blocked" message.
After the migration, the Google identity does not need any cookies, whatsoever, Google picker is somewhat unaware and stops working with 3rd party cookies blocked.
After the picker is successfully loaded, he prompts the user to SignIn (even though it just received a working token via setOAuthToken). After clicking the SignIn twice in the iframe, there is some malfunction error. Nothing is ever opened. NO callbacks are aware of this, no errors can be caught.
This behavior can be directly controled by the 3rd party cookie block. If the cookies are allowed. The exact same flow (and code) opens google drive picker (via build and setVisible) and everything works as expected.
The question is.
How to catch this 3rd party cookie error? Or any errors in the iframe whatsoever.
Why the picker requires 3rd party cookies?
Should I do something on the picker side for the migration as well?
Drive Picker and Drive API Third-party cookies
This has been reported as an issue from the community, I would highly suggest to also provide the feedback and insight regarding your concerns and future alternatives:
https://issuetracker.google.com/issues/188699186
Replying to your questions:
How to catch this 3rd party cookie error? Or any errors in the iframe whatsoever?
As suggested over the Issue tracker, it is not possible to catch information about the matter.
Why the picker requires 3rd party cookies?
It would be a great idea to request a better documentation on why over the issue tracker, as it was also suggested on a previous old post:
https://issuetracker.google.com/164130212
I notice that other types of Drive API process that can be troubleshooted generally recommend enabling or as an alternative to add an exception for accounts.google.com.
Should I do something on the picker side for the migration as well?
It seems you have followed the process of migration correctly, this is only a limitation from Drive Picker itself or the Drive API needing access to those cookies to run properly, might be a good test the exception suggested in the previous answer.
References:
https://developers.google.com/drive/api/troubleshoot-authentication-authorization
https://developers.google.com/identity/sign-in/web/troubleshooting#third-party_cookies_and_data_blocked
Related
I maintain an application written in C++Builder 2009. Part of it involves using a TWebBrowser control (based on Internet Explorer) to send users to a Google login page in order to obtain an OAuth key. This has worked well for a while, but now Google, bless their hearts, has implemented some kind of security upgrade, and now my users get to a page that says "Couldn't sign you in, this browser or app may not be secure". FYI, I am already setting a Registry key that is supposed to make IE run in version 11 emulation mode.
I do have a couple of workarounds: If the user runs IE first in admin mode, signs on, leaves it up while running my application, we don't get the problem. Second, I can start up the default browser - Chrome, IE, whatever - and send them to the URL for OAuth, then it avoids the error message.
The problem with this solution is that without being able to hook into TWebBrowser events, I don't have any way to automatically retrieve the OAuth key - it is necessary for the user to cut/paste it into my application. I'd like to avoid these clunky solutions.
I should also mention, this problem occurs only for certain Gmail accounts. I have no idea what the difference is between accounts that work and don't work. Any ideas on that?
So, is there any way to configure IE or TWebBrowser so this security issue is bypassed? Or, if I was to update to a modern version of C++Builder and use TWebBrowser (or something else?), would this problem be avoided? Any other ideas to fix this problem?
The latest C++Builder supports Google's Chromium engine, it's probably safe to say it'll be compatible with Google's security upgrades.
Powerful Chromium Based WebView Component To Host Web Content In Your Delphi/C++ Builder FireMonkey Apps
I am trying to access some services that require a google login. I thought it would be a really neat idea to automate it and have been trying to do so. Whenever I use my script to try and log in, however, I get this message:
This browser or app may not be secure. Learn more
Try using a different browser. If you’re already using a supported browser, you can refresh your screen and try again to sign in.
How do you go about getting around this? I tried researching it but came up with blanks. Is it possible to be logged in prior to running your script?
Logging in to Google is still possible (by exploiting a bypass).
By default, Google detects and effectively blocks all logins from Selenium webdriver.
The following link comes from the Google OAuth Playground, ensuring the practicality of the link. It most likely won't expire any time soon.
https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?redirect_uri=https%3A%2F%2Fdevelopers.google.com%2Foauthplayground&prompt=consent&response_type=code&client_id=407408718192.apps.googleusercontent.com&scope=email&access_type=offline&flowName=GeneralOAuthFlow
You can use that link (ie. driver.get()) to log into your Google account.
This bypasses the automation checks allows you to log into Google using Selenium. At least for now.
UPDATE: As of January 2021, this no longer works.
So I'm trying to register a new client on the instagram API. I have a business account and have done the proper steps prior to this. Everytime I fill out the "Register New Client ID" form and submit it, I get an error "The captcha solution was not correct. Please try again." But no there is no captcha for me to fill out!! Looking at the console errors it says the CSP page setting's are blocking this source https://www.google.com/recaptcha/api.js. I'm gonna take a wild guess and say that has the captcha I need that's not appearing..lol.
Anyway, I've disabled all my content blocking settings and JS is enabled on firefox (oh I'm using firefox developer edition btw) and no change. I've also tried this in chrome and safari, no change. I don't have this issue with other sites that use captchas.
Anyone have any idea what's going on?
'preciate it!
Had the same issue here on Google Chrome. Used IE11 (version 11.345.17134.0 to be exact), and captcha displayed instantly. I've successfully registered a new client
I suggest to wait until Instagram team realizes to upgrade their whatever scripts & parameters.
I found myself in the same scenario:
I'm logged on Instagram
I land to instagram.com/developer/clients/register/ over Google Chrome 70.0.3538.102 (no extensions)
No captcha. And I get the following from the console:
ps: I tried figuring out how to submit this specific report, but after several searches I find myself loosing too much time... to make them aware.
I privately host a site for my family that uses the Google Spreadsheets API (readonly). I received an email from google looking to "Remove risky access to your data". My site is listed with a warning:
I've gone through the verification process (filling out this form: https://support.google.com/code/contact/oauth_app_verification) but got the response that if the site is used privately "you don't need to go through the verification process". They state this in their FAQ also: OAuth Developer Verification Form FAQ.
However, the site still shows a warning in Google's security check-up. I can ignore this but I think other family members will be worried unnecessarily OR ignore future warnings about other apps assuming it's the family one they normally ignore.
Is there a way to verify myself as a developer of a private site or mark the access as trusted so the warning doesn't recur?
I ended up making my site public and going through the usual verification process.
Not really an answer, but rather to flag that this is an issue my dilemma as well. Although I run time-based Google Script within an organization. I've contacted folks at the Google Cloud Platform and they have opened a case. However, here is something interesting I've stumbled across just now. Go to your Google account and do Security Checkup
After the checkup your screen might be showing something like this
Try clicking "Dismiss" to prevent Google from removing your app.
I'm just testing it myself and if in an hour (that's how long it usually takes Google to remove your own script from the list of self-authorized apps with access to account info) Google won't remove it, I guess it would work for me!
Got the following exception when calling api (/me) using the latest PHP SDK.
OAuthException: Cannot call API on behalf of this user.
The same exception appears for some facebook account only. Any clue?
I found the source of the problem (on our site, at least). In Facebook's developer console (https://developers.facebook.com/apps), our app was showing an invalid privacy policy. Due to this, Facebook had automatically placed our app into Sandbox Mode.
Updating our privacy policy and (more notably) removing our app from Sandbox Mode caused this error to cease.
Other users seem to have had some success with removing regional (country-specific) restrictions on who can and cannot log in to their app (https://groups.google.com/forum/#!topic/django-social-auth/XaE5dFXEqhA)
Additionally, #Igy's questions sound reasonable and might lead to finding a solution as well.
Best of luck! :)
Is that user's access token still valid? Has the user blocked you? Can you navigate to the user's profile manually? (i.e their profile might be unavailable)