[webview_flutter] google oauth login issue

[bwikbs]

From @JRazek

Hello, I am trying to run google oauth login in an app. For that I am using webview.
Ive changed a user agent to a google chrome. After inserting credentials google redirects me to a page with a message
"Browser or app may not be secure. Try using a different browser."
When I try to launch the same url in google, it works fine.

[swift-kim]

I'm not sure if it's exactly the same issue but AFAIK, Google OAuth doesn't support signing in with embedded webviews.

https://stackoverflow.com/questions/69330419/electron-google-login-this-browser-or-app-may-not-be-secure

[bwikbs]

Thanks for letting me know!
It could be a problem for us... 😢
And.. It's still interesting how to block it (even if some call it a around...there are still many browsers out there...).
I'll check it out a bit more and let you know if I have something to share...

[bwikbs]

@JRazek
Did you say this(sample code) worked in chrome? am I right?
What's the device you used at that time? PC?
I'd like to know It worked properly with chrome on a real device (like TV or tm1 or rpi4..).
We currently consider using ewk_webview or using a browser for this. But I wonder if this is the way Google allows it. so i'm asking these question..

[JRazek]

@bwikbs The url that is hardcoded into sample code, I pasted in a chromium/google chrome/firefox on my PC with ubuntu. They worked fine. :)

[bwikbs]

@JRazek
Can you work now using browser?(what we talked about in messenger)
chromium flutter webview (ewk) is currently unstable and out of date. I expect it will take some time to prepare it.
I would like to know if you want to use chromium webview even if it is unstable (not highly recommended).

[swift-kim]

OAuth 2.0 for limited-input devices now has email and profile as its allowed API scopes (previously only the YouTube and Drive APIs were supported as far as I remember) and I think it would be feasible to implement the google_sign_in plugin for Tizen using this option (although the user will not have full capabilities). How do you guys think?

Previous issue: #151

[bwikbs]

Clearly that's good news. 👏 I think it's worth a try.

It's a little different story..
In case of flutterfire_desktop , I guess it use desktop_webview_auth so.. we still need to consider using webview at this moment.

---

Plz, Ignore my comment. There is misunderstanding on OAuth 2.0 for limited-input devices

[HakkyuKim]

I've tested signing in with Google account on TV devices according to the guide OAuth 2.0 for TV and Limited-Input Device Applications: example app (internal repo). Note that the example uses Device Authorization Grant which has a different authentication flow from Authorization Code Grant that's typically used in mobile or desktop devices where browser and input capabilities are available.

google_sign_in internally calls platform native google signin APIs (Google Play Services API for Android and GoogleSignIn-iOS for iOS) to create native UI popup/dialog screen that can take input during signin. For example, in Android, the API starts another Activity that allows user to input Google account id and password. When user consent is finished, platform plugin sends the received access token back to dart side so that Flutter app can use it to call Google APIs.

AFAIK, this can't be done in Tizen. We could create and show a Flutter Widget in platform channel implementation, but it requires an extra step in the client code. The simplest solution I could find is guiding users to fill GlobalKey<NavigatorState> parameter in MaterialApp (or CupertinoApp).

MaterialApp(
    title: 'Limited Input Device Google SignIn Demo',
    theme: ThemeData(
    primarySwatch: Colors.blue,
    ),
    // This step is neceassary to show signin screen made with Flutter widgets
    // in platform channel implementation.
    navigatorKey: signin.navigatorKey,
    home: const MyHomePage(title: 'Google SignIn Home Page'),
);

I believe this limitation is OK if we provide proper error messages when users forgot to pass in navigatorKey. Please see the example app for details.