auth().signInWithPopup failing for Facebook on Firefox

[theprojectsomething]

• Operating System version: macOS 10.13.5
• Browser version: Firefox 61.0.01
• Firebase SDK version: 5.2.0
• Firebase Product: auth

Describe the problem

Firefox's Facebook container seems to be causing the auth().signInWithPopup flow to fail at the redirect and close stage.

The popup window logs the warning "Scripts may not close windows that were not opened by script."
The SDK returns "The popup has been closed by the user before finalizing the operation."

Realise this is due to an addon, but it seems like it might be a fairly common issue amongst Firefox users given its popularity. It's definitely causing me heartache. I'd file a bug with Mozilla but I'm not sure of the exact details, i.e. is this likely to effect most oauth implementations?

Steps to reproduce:

• use Firefox with the Facebook Container addon enabled
• attempt the signInWithPopup auth flow, using Facebook as the auth provider

Relevant Code:

const provider = new firebase.auth.FacebookAuthProvider();
firebase.auth().signInWithPopup(provider).then(e => console.log)
.catch(e => console.log);

[HectorBlisS]

Same here U_U

[sadalsuud]

I have the same problem ... :c

[paolodesa]

Same problem also for me.

[Amaimersion]

Same for me.

[tzah4748]

Same problem here!...
This seems like a common bug, thanks to your help now at least we know what to tell the users when this error shows up and how to deal with it

On the bright side we can always disable the add-on
On the not so bright side (For Mozilla) some people will just change browser...

[alkymst]

I'm also seeing this for Github in Firefox for signInWithPopup as well, signInWithRedirect it fails with no errors. However this is only happening for one user. We can not seem to figure out why.

Firebase SDK version: 6.0.2
Without the Firefox container addon

  const authenticate = provider => {
    console.log('Logging In');
    const authProvider = new firebase.auth[`${provider}AuthProvider`]();
    firebase
      .auth()
      .signInWithPopup(authProvider)
      .catch(err => {
        console.log(err);
      });
  };

{
code: "auth/popup-closed-by-user"
message: "The popup has been closed by the user before finalizing the operation."
}

Any insight would be helpful.

[rootux]

Still happening

[rootux]

And Still happening

[rommelpe]

@rootux I was able to test signInWithPopup in Firefox v60.0 (with default browser settings) without having any issues. There must be some issues with the browser used. It could be set to block popups.

[theprojectsomething]

@rommelpe the original issue is specifically referring to Firefox version 61 with Facebook container. I've checked your test case and the problem persists in Firefox 70 / 71.

[rootux]

Exactly. As @theprojectsomething suggested.
@rommelpe try to open a firebase app from within Facebook using their Facebook container and you'll be able to reproduce.

[rommelpe]

@theprojectsomething @rootux ops missed that, my bad. After adding Facebook container, I ran into the same issue.

It seems that it is working as expected as the plugin itself says:

Websites that allow you to create an account or log in using Facebook will generally not work properly.

It would be helpful if you could reach out to them. They may be able to provide some points to resolve the issue.

[theprojectsomething]

@rommelpe thanks, yes the plugin is definitely working as expected - it's fbauth that's not.

Currently fbauth simply fails silently (albeit with a popup error). Given the proliferation of blockers and contextual containers I guess a basic suggestion would be to return a clearer error that doesn't require a lot of research.

Building up from that, a message in the oauth window explaining that it is unable to communicate with it's parent, along with some instructions to the user on how to resolve things (perhaps providing a link to be pasted into the original context?) would be a great outcome.

[rootux]

@rommelpe Thank you.
This is pretty serious in my opinion.

I believe this bug is serious then what originally reported.
The above means that Firebase apps won't allow authentication from within Facebook containers (Not only through the exception but through any Facebook based container aka Facebook browser (For example - used through mobile phones)

As @theprojectsomething suggested, a message in the oauth window with instructions would be a better practice here then failing silently.
Thank you.

[rommelpe]

Thanks for all the inputs. While this is currently an expected limitation, we'll treat this as a feature request and keep this open.

[filipsuk]

Any updates on this or possible workarounds please? Our firebase app is not usable when shared over facebook (mobile user opens it in facebook container).

[damechen]

Any update? My user is hitting the same issue.

[tzah4748]

This seems like an issue with FF or the Extension itself, and i don't think either will try to fix this.
Tell your user(s) to disable the Facebook container extension.

[rootux]

It's beyond the extension and happens to many users that does not have that extension installed

…

On Sat, 11 Apr 2020, 10:29 Tzah Mazuz, ***@***.***> wrote: This seems like an issue with FF or the Extension itself, and i don't think either will try to fix this. Tell your user(s) to disable the Facebook container extension. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1003 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAH4CTVR5TQXEZD6QLUIKI3RMAL6TANCNFSM4FJT2GPA> .

[olso]

Same thing happens with Google now

[theprojectsomething]

@olso can't reproduce the issue with Google sign-in (or in Chrome if that's what you meant) .. unless there is a google container installed? Assume that would break Firebase in more ways than just auth.

[looptheloop88]

Hi All, this behavior is still reproducible using the latest version (8.6.1) of the SDK. If your Mozilla Firefox browser has Facebook Container addon or extension enabled, Firebase Facebook Authentication will fail.

I've filed a bug for internal tracking. We can't provide timelines or details, so keep an eye out on our release notes or this issue thread to get updates in the future.

[weixifan]

For reference the internal bug is b/188185399.

[eidan66]

Hey!
Using Firefox version:89.0 (64-bit), I get the same errors for facebook&google login.
the errors:
1-
Opening multiple popups was blocked due to lack of user activation.
2-
The popup has been closed by the user before finalizing the operation

Any help will be good.

[theprojectsomething]

@eidan66 that looks like the popups have been blocked, it's not caused by the Facebook container.

If you click the page settings icon, directly to the left of the url, you'll be presented with a permissions overlay where you can allow popups. Alternatively, follow these official instructions to resolve (note that the UI presented in the docs is old)

[verma1019]

I have fixed this issue. The problem is that I was triggering the popup on click of a button but I was not adding the type="button" attribute in my tag.

So what I did is following, I added type="button" and voilaaaaa, It fixed my problem.

Sign In With Google

[olso]

@verma1019 this doesn't work for me, we had this since the beginning

[MdYeasinSamadArnob]

@verma1019 this doesn't work for me, we had this since the beginning

Have you been able to solved it?

[arLevi]

@verma1019 if type="button" fixed your issue you probably had the button inside a <form> and w/o the type it will behave as a submit therefor you tried to do two things at once. adding type="button" fixed it because now you're not submitting the form maybe ?! ...
anyway, i had it before, this didn't solve me, but thanks for sharing !

In my case I use signInWithRedirect with Google and it seems that nothing happens after the redirect goes back to my page beside the listener for onAuthStateChanged where it says that there's no user and then I clear some stuff ... :/

[smac89]

I solved this issue for myself today (for firefox mobile).

The problem seems to stem from the way firefox detects malicious popups: If the popup was not opened directly as a result of some user action, then the popup is temporarily blocked until the user allows it through.

In my case, I was generating a recaptcha code before opening the popup, and this was apparently what was causing the popup to be initially blocked. After I changed the code to open the popup first, then do the recaptcha stuff, I was no longer getting any dialogs to allow popups/signinwithpopup was now successfully running.

---

EDIT:

As per this comment, it seems the default action by firefox is to block all popups (...which do not result from a user action. However, it seems their heuristic for detecting this may need some tweaking).

However, due to this other bug firefox does not remember the choice of the user, so it ends up never allowing popups to display.