Brave-browser: Cannot login to expensify (Google Auth)

[bbondy]

Description

Logging into expensify no longer works unless cookies are allowed.

Steps to Reproduce

Scenario A: Problem.

1. Go to https://www.expensify.com
2. Try to login

Scenario B: All OK.

1. Go to https://www.expensify.com
2. In the shields panel, allow cookies.
3. Try to login, it works.

Actual results for Scenario A:

It will stay at the login page.

Expected results for Scenario A:

You should get logged in.

Reproduces how often:

Always, tried on Release - Nightly.

Brave version (brave://version info)

I tried on both 0.68.x and 0.71.x

Version/Channel Information:

• Can you reproduce this issue with the current release? yes
• Can you reproduce this issue with the beta channel?
• Can you reproduce this issue with the dev channel?
• Can you reproduce this issue with the nightly channel? yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? yes
• Does the issue resolve itself when disabling Brave Rewards? n/a
• Is the issue reproducible on the latest version of Chrome? no

Miscellaneous Information:

[rebron]

cc: @ryanbr Can you take a look?

[ryanbr]

Managed to get this to work in Brave release (Version 0.68.132 Chromium: 76.0.3809.132 (Official Build) (64-bit)). No changes to the sheilds needed

https://secure.fanboy.co.nz/gif/expense.gif

Saw no cookie issues, nothing to stop the login (and logging out) performing as intended.

[bsclifton]

Verified this works great for me too on a fresh profile (Release and Nightly channels). @bbondy does it happen for you on a clean profile? Are you on VPN? (maybe they have a Canadian site and if you're on VPN, there may be a conflict with hostname? just a guess)

[ryanbr]

Just a re-test in Brave Release and Beta channels, was able to login/logout without issue. Nothing in the erroring in the console. and the most being blocked;

https://stats.pusher.com/timeline/v2/jsonp/1?session=
https://cdn.heapanalytics.com/js/heap-3307740814.js
https://ssl.google-analytics.com/ga.js

No cookies or Device recognition issues being blocked. Could've been server-side issue?

[bsclifton]

@ryanbr I believe this is happening when signing in using Google auth (both @bbondy and @diracdeltas have ran into this also). Can you give that a shot?

[ryanbr]

Okay, can reproduce. even with sheilds down. Having issues in Chrome also, unable to login via chrome using the google auth. .

[ryanbr]

In chrome, I needed to allow cookies on https://[*.]accounts.google.com:443 for google auth to work

[diracdeltas]

btw this definitely worked in Brave for me as of about 4 days ago. i think it might be because i updated to 0.68.138 in that time?

[ryanbr]

I wonder if its related to this landing; https://github.com/brave/brave-core/pull/2488

[ryanbr]

We got another report issues using google auth.

https://community.brave.com/t/google-auth-unable-to-login-even-though-i-allowed-the-google-auth-permission/84044

https://pages.lazada.com.ph/

Only seemed to work if we allowed all cookies.

[ryanbr]

A few examples of allowing cookies is needed;

https://community.brave.com/t/cannot-sign-in-to-playstation-vue/83515/15
https://community.brave.com/t/nest-quit-working/84163/5

[bsclifton]

Assigning @jumde who should be able to check this out 😄

[tomjadams]

Can confirm I get this on expensify too using Version 0.69.135 Chromium: 77.0.3865.120 (Official Build) (64-bit) (on a Mac)

[luucamay]

I also get this using Version 79.0.3940.0 (Official Build) dev (64-bit) (on a Pixelbook - Chrome OS)

[szeitlin]

fwiw this doesn't work in Chrome, either.

[LaurenWags]

Verified passed with

Brave | 1.3.88 Chromium: 79.0.3945.117 (Official Build) beta (64-bit)
-- | --
Revision | 04f0a055010adab4484f7497fbfdbf312c307f1d-refs/branch-heads/3945@{#1019}
OS | macOS Version 10.14.6 (Build 18G103)

• Reproduced the issue using 1.2.42 Chromium: 79.0.3945.117 and confirmed unable to login using Google Auth
• Verified test plan from https://github.com/brave/brave-core/pull/3784
• Verified for clean and upgrade profiles

Verification passed on

Brave | 1.3.90 Chromium: 79.0.3945.117 (Official Build) beta (64-bit)
-- | --
Revision | 04f0a055010adab4484f7497fbfdbf312c307f1d-refs/branch-heads/3945@{#1019}
OS | Ubuntu 18.04 LTS

• Verified test plan from https://github.com/brave/brave-core/pull/3784
• Verified for clean and upgrade profiles

Verification passed on

Brave | 1.3.91 Chromium: 79.0.3945.117 (Official Build) beta (64-bit)
-- | --
Revision | 04f0a055010adab4484f7497fbfdbf312c307f1d-refs/branch-heads/3945@{#1019}
OS | Windows 10 OS Version 1803 (Build 17134.1006)

• Reproduced the issue using 1.2.42 Chromium: 79.0.3945.117 and confirmed unable to login using Google Auth
• Verified test plan from https://github.com/brave/brave-core/pull/3784
• Verified for clean and upgrade profiles

[chrisjenx]

Is this meant to fix all Google Auth or just Expensify? Cause I still have issues on basically every site that uses Google + Firebase

[szeitlin]

Is this meant to fix all Google Auth or just Expensify? Cause I still have issues on basically every site that uses Google + Firebase

FWIW I ended up just logging in with the email option instead, and that worked.

[jumde]

Hi, @chrisjenx , could you share an example of a site that is not working for you. Thanks!

[chrisjenx]

@jumde mine - https://haynet.horse Brave will complain about the 3rd party cookies in reference to the google login (powered by firebase).
This isn't the only site, just very easy to test on.

[jumde]

Thanks @chrisjenx , I'm able to reproduce. Filed a new issue for tracking this: https://github.com/brave/brave-browser/issues/9852