OAuth 2.0 authorization endpoint in embedded webviews

[smartin015]

Original article: https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html

Deadline: February 6, 2023, any login attempts via embedded webview will receive a disallowed_useragent error.

Note: users should receive a "warning message" when attempting to authorize in an embedded webview

Methods of login:

• Guest account on android: requires logging in to access play store, so no problem
• From android/ios app: uses cordova-plugin-googleplus which uses a native sign-in method and not sign-in via webview. This thread suggests that there's no issue here, and in fact users may be attempting to login to a web version of the app but with a webview from another app, e.g. FB Messenger.
• From messenger webview: "Access blocked: Authorization Error": "this app doesn't comply with Google's secure browsers policy" with error 403: disallowed_useragent
• From Firefox on Android: can login just fine.

It appears this is not an issue for our app, only for users which attempt to login to the app by using their own webview. Furthermore, webview blocking seems to already be in place. @toddmedema - it looks like there's no action required here, do you agree?

[toddmedema]

Confirmed, looks good and makes sense