search

uhm-coe / authorizer

Authorizer is a WordPress plugin that uses Google, CAS, LDAP, or an OAuth2 provider for logins, and can prevent public access to a WordPress site. It also blocks repeated failed login attempts.
GNU General Public License v3.0
65 stars 38 forks source link

Add FedCM - Google Login being blocked due to third-party cookies #157

Closed faeldray closed 1 month ago

faeldray commented 3 months ago

We have several WP sites that I've recently begun using this plugin on because the company uses Google for our accounts and it just makes logging in much easier. Everything has been going fine until one user and myself began getting the error "Invalid Google credentials provided" when we tried to log in, despite just logging into our Google accounts and being able to access email and such just fine. While trying to diagnose the issue, I noticed in the address bar of a private window that there was a notification saying that third-party cookies were being blocked. Once I allowed third-party cookies, I was able to log in without issue.

My best guess is that this is caused by Chrome's progressive removal of third-party cookies, which they began rolling out earlier this year (I'm using Vivaldi, an offshoot of Chrome). Which would explain why some users are experiencing the issue but not all.

It appears that the solution is to migrate to the FedCM API. So if that's something that could be implemented, that would be greatly appreciated, because I imagine the issue is going to get even more prevalent.

figureone commented 3 months ago

Thanks, we'll take a look at FedCM and see if we can switch over to it. We're using the official Google PHP API to integrate with Google, so hopefully it's pretty straightforward. https://github.com/googleapis/google-api-php-client

figureone commented 2 months ago

Reading up on Google's FedCM docs, it looks like they intend to automatically transition everyone to FedCM. But we can test forcing the behavior in Authorizer to catch the edge cases you are experiencing.

Can you try patching the Authorizer source to include the FedCM flag and let us know if that resolves the errors you are seeing in Vivaldi? Specifically, add this:

    data-use_fedcm_for_prompt="true"

As an attribute to div#g_id_onload here: https://github.com/uhm-coe/authorizer/blob/master/src/authorizer/class-login-form.php#L190

figureone commented 1 month ago

Aloha @faeldray, checking in whether adding data-use_fedcm_for_prompt="true" solved the issues you were seeing with third-party cookie blocking in the Vivaldi browser.