Firebase-js-sdk: Google Sign In not possible from within electron

[TomTomB]

Describe your environment

• Operating System version: Windows 10 Build 1909
• Browser version: Electron 7.1.7
• Firebase SDK version: 7.6.1
• Firebase Product: auth

Describe the problem

I am not able to sign in with my Google account. After clicking the sign in button inside the popup the following message appears:

This browser or app may not be secure.
Try using a different browser. If you’re already using a supported browser, you can refresh your screen and try again to sign in.

I´ve already resolved every electron security warning

Steps to reproduce:

I´ve prepared a repo to reproduce this issue. You can find it here

[bojeil-google]

We don't support popup/redirect sign-in operations in Electron. The error message also does not appear to come from our SDK. Are you using the Google sign in library?

[TomTomB]

I´ve read this Medium article about using Firebase with Electron and it´s caveats. After that, I´ve resolved every issue that may appear (like getting Firebase to think its not being ran inside an node env) and created the issue repo mentioned above.
My actual project is using the Firebase SDK wrapped within the Angular/Fire package, nothing else.

[hsubox76]

It seems like this may be an issue with Google Sign-In and not Firebase. It seems from this issue, which is about using Google Sign-In in Electron, without Firebase, that it may have to do with Chrome or some back-end security requirements of Google Sign-In. https://support.google.com/accounts/thread/22873505?hl=en

[TomTomB]

Apparently, for whatever reason, the issue is caused by the User Agent.

Steps to reproduce:

• Open Dev Tools inside the Google Sign-In popup
• Open the Network conditions tab (which can be found inside the 3 dot menu -> More Tools -> Network conditions)
• E.g. choose the "Firefox - Windows" User Agent
• Reload the page
• Sign in works

Is there, by any chance, a way to change the User Agent before opening the popup dialog?
I´ve already looked inside the Electron "new-window" Event but without success.
It´s only possible to edit the User Agent via Session.setUserAgent and inside the window.loadUrl options.

[hsubox76]

I don't think the best solution is to have Firebase open up the capability to spoof a different user agent when opening a popup window, it doesn't seem like a good practice in general.

Have you tried using Electron's userAgentFallback as described in this Reddit thread? https://www.reddit.com/r/electronjs/comments/eiy2sf/google_blocking_log_in_from_electron_apps/

[TomTomB]

Me neither. I can confirm that setting app.userAgentFallback to e.g. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) old-airport-include/1.0.0 Chrome Electron/7.1.7 Safari/537.36 fixes the issue.

Hopefully this workaround won't be need for ever from now on.

[malcolmdeck]

It sounds like this issue is resolved - a workaround is explained above, and we don't intend on supporting this directly at this time.

[kbourro]

It seems that user-agent bypass stopped working.

[varun508]

useragentfallback isn't working anymore. Any update on that?

[malcolmdeck]

Can you please go into a little bit more detail about what's broken with that workaround now? Is it a problem with Google Sign-In or Firebase Auth? What error are you getting? Again, we don't support popup/redirect sign-in operations in Electron, but I'll try to help if I can.

[bartoszhernas]

The issue is that for some accounts, Google is blocking login page when that page was opened in Electron window. This only happens for some accounts and not all, which is really weird.

Changing user agent of Electron worked for some credentials, but we are still getting errors that users are not able to log in :(

[pejmanjohn]

I am seeing this issue as well. I have a private Google Spreadsheet in a webview in Electron. In order to view it I have to sign into my Google account first but after I enter my email address and hit continue I see this: "This browser or app may not be secure."

[tofutim]

the fun may be over :(