search

react-native-google-signin / google-signin

Google Sign-in for your React Native applications
https://react-native-google-signin.github.io/
MIT License
3.13k stars 876 forks source link

Google OAuth / Embedded WebView Warning? #1154

Closed scgough closed 1 year ago

scgough commented 1 year ago

Hi - just to note this is more a question than an issue.

I have received a message from Google stating that part of the Google Auth flow (which uses this package) is potentially using a WebView on either iOS, Android or both. Has anyone else received this warning? I'm wondering could the issue is actually part of the Google SDK dependancies?

There is a fairly strict time limit (May 2023) to resolve the issue before users start receiving the disallowed_useragent warning. It will then be fully blocked as of July 24, 2023.

I would appreciate any insight into this and I am more than happy to help try and resolve the issue (if there is one!).

annuh commented 1 year ago

This looks related to https://github.com/react-native-google-signin/google-signin/issues/1107? According to that issue we shouldn't have a problem.

I haven't been able to verify this via https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html?m=1#test.

vonovak commented 1 year ago

Hello and thanks for asking, it appears that the google sign in web sdk is being deprecated but that does not have effect on the native sdks.

see also #1107 #1142

Thank you 🙂

scgough commented 1 year ago

So the only thing jumping out from the article @annuh linked is this:

A "Web application" client type in use by an Android application is an example of mismatched use.

For Android, a webClientId is required (for 'offline' access) to verify user ID and offline access. Maybe here is where the issue lies?