Google-api-javascript-client: Google Sign-In failing with popup_closed_by_user

[josephfoulds]

We're running using Google Sign-In to authenticate users to our service and have recently become aware that for a small subset of users the gapi.auth2.getAuthInstance().signIn() call is failing with popup_closed_by_user error across a range of devices (Chrome, FireFox, Safari, Safari Mobile) for users which have confirmed that they do not have third party cookies blocked (we are aware this could be causing issues).

This bug is not reproducible by us directly _(since we do not know what is causing it)_ but we have confirmed with a number of users that they are not blocking third party cookies and have no privacy related browser plugins installed which may be interfering with the login flow.

Login snippet with error catch:

gapi.auth2
        .getAuthInstance()
        .signIn({ scope: 'profile email', prompt: 'select_account' })
        .then(
          user => {
            resolve(this.getDelegatedLoginParams(user))
          },
          err => {
            // May throw an error if the user is not allowing third party cookies
            if (!nullish((window as any).Bugsnag)) {
              Bugsnag.notify(
                '[Login Error]',
                'Login Failed',
                { gapi: err }
              )
            }
            reject(err)
          }
        )

Looking back through Github issues and Stackoverflow questions, it appears that popup_closed_by_user is a frequent issue for gapi.

Are we aware of any potential issues or remedies for this?

[mamsori]

We are having same issue with IE11 inprivate mode.

[ianp]

I am seeing the same behaviour in Chrome 74.0.3729.6 (Official Build) dev (64-bit), with _no_ extensions enabled. Rendering the button using

function renderButton() {
  window.gapi.signin2.render('signin-button', {
    scope: 'profile email',
    width: 240,
    height: 50,
    longtitle: true,
    theme: 'dark',
    onsuccess: onSignInSuccess,
    onfailure: console.error
  })
}

As I am able to reproduce the issue, I'm open to suggestions as to how I may debug this!

[ianp]

I can provide a little more info on this: if I clear out all of the cookies and then reload the page, the signing window stays open and _appears_ to work OK in that I can select a user and enter my password, but the onfailure handler still gets called with popup_closed_by_user.

Reloading the page again (with cookies left in place) results in the sign window appears briefly with no content then closes with the same error.

[emhagman]

We just experienced this exact issue on Chrome 73 on Windows 10.

[lopugit]

I'm getting this too on chrome 74.0.3729.131 windows 7

It's working on chrome 74.0.3729.131 OS X LMFAO

GG GOOGLE

[matixmatix]

I'm unable to reproduce this myself (Chrome 74.0.3729.157 macOS), but am seeing a small subset of users in our bug reporting tool having this exact issue using the same build and OS.

This seems to be an ongoing mystery issue in Google Sign-In client. Could there be some browser extension causing this behaviour?

[josephfoulds]

@matixmatix This is pretty much exactly my situation. I've been unable to reproduce on countless browsers and OS, but have seen a steady trickle of errors in Bugsnag (coupled with user reports matching the same issue) for quite a while.

I've been entirely unable to reproduce the problem, but it's definitely affecting our users - albeit a small subset.

From user interviews (and bug reports) this appears to be affecting a variety of browsers (have seen it cropping up on FF as well as Chrome at least) and I haven't been able to find any third party browser extension (again, no matching extension for all users) - nor have I been able to reproduce by installing the same extensions on a fresh install and browser version as the user.

Frankly, I'm really at a loss with how to handle this - feels like I'm looking for a specific piece of hay in a haystack...

[lopugit]

@josephfoulds @matixmatix

Have you tried multiple google accounts being logged in when trying? So there's multiple accounts to choose from when authenticating?

[josephfoulds]

@lopugit Yes, have checked previously and just verified on 74.0.3729.131 (Official Build) (64-bit) on Mac OS X. When triggering the login flow with multiple accounts to chose from, I am given the option to select an account to login with and the login flow works correctly as expected (you chose an account and then log in successfully).

[lopugit]

@josephfoulds it seems to be fixed now ?! working for me :)

[asiurob]

I updated to Versión 76.0.3809.87 (Build oficial) (64 bits) and the error has gone

[ThisIsNoZaku]

Encountering this issue in Chrome Version 78.0.3904.97 (Official Build) (64-bit) on Windows, using window.gapi.auth2.getAuthInstance().attachClickHandler()

I'm not able to reproduce this 100% of the time but when this error begins to occur, any further attempts to authenticate in the same browser tab will fail for an indefinite period of time. If I open a private window, it will begin to work in that window but can begin failing again.

While the bug is occurring, clearing cookies and local storage does not fix it; it will cause the login to prompt for the account selection and username and password again but will continue to fail.

[gitsuneethav]

I'm on Chrome Version 81.0.4044.26 and i can reproduce this issue consistently. I'm using the auth2.getAuthInstance().attachClickHandler() api.

[mchrupcala]

I'm consistently seeing the same error on my Chrome v 80.0.3987.149 (Official Build) (64-bit). "Popup_closed_by_user" will print when I call auth2.getAuthInstance().signIn(), and my browser's _not_ blocking 3rd-party cookies.

What's strange is that I can trip this error twice in a row, when I try to auth, log the error once, then when I click the auth button a 2nd time. This even happens when I log out completely of all my Google accounts & delete localhost cookies. But then as soon as I refresh my page, I'm logged in and I reload my page, I'm logged in and the app works as expected.

@josephfoulds any chance ya'll have found a fix?

[wasyyyy]

@mchrupcala Does it happen in incognito mode? Manipulating the cookies may lead to an undesired state which caused similar issues to me while I was testing with my site.

[mchrupcala]

@wasyyyy yeah unfortunately I'm seeing the exact same performance in incognito mode- multiple error messages, then after I reload the page I'm successfully logged in.

[wasyyyy]

@mchrupcala interesting. Do you have a link to your website? I've seen this kind of issues before but starting a new incognito mode usually fixes it. So I assume these could be caused by me messing up with the cookies and local storages. Have you tried clearing the local storage and session storage?

[mchrupcala]

@wasyyyy yep thank you for taking a look! Here you go https://tagger-fe-revert.now.sh/inbox
I've replicated the errors when I clear local storage, cookies & session storage. Also when I'm logged into just one google account (this issue's also caused by multiple logged-in accounts from what I read online).
My team wants to share this and so if users have to use incognito or a specific browser it'll cause problems down the road.
FYI when you log in - the permissions we ask for are pretty wide, no sweat if you don't want to try it. But we only add labels to your Gmail account (which can be deleted) and don't make other changes.

[wasyyyy]

@mchrupcala I couldn't reproduce this issue on other similar websites. But I do see it happening consistently on your site. I don't know exactly why it happened. How did you use the sign in API? I was trying to find sign in related code on your website. It looks like you are trying to trigger the popup multiple times (I see you call signIn() after grantOfflineAccess(), both would popup normally), but the popup was actually only triggered once, I sense there might be some weird race condition happening?

If you call grantOfflineAccess(), it should has already signed the user into your site, why do you need to call signIn() again?

[mchrupcala]

@wasyyyy it's fixed! To be honest, I haven't looked at this code in a few months so I can't remember exactly why we called grantOfflineAccess(), but I believe it had to do with persisting the user's profile if they're kept logged in after visiting the site once. I commented this out and called our onSignIn() function and everything worked as-expected.
Thanks so much for all your help!

[OdifYltsaeb]

I still see this error. both with signIn() and grantOfflineAccess(). It does not affect many people since the whole app is still in dev stage... but with gapi working like this, I feel like I need to explore different options - especially since according to different error reports and messages here and there it seems to pop up out of the blue here and there.

Strangely enough, though, it DOES NOT happen, when I open a new private window. Then the exact same code runs just fine and results in a successful authentication.

Since this issue is open and has been open for over a year - If you guys are willing to work on fixing this issue I can make me available for debugging and providing extra info on this end.

[soylomass]

Having the same problem with attachClickHandler in localhost

[pmelander]

I have the same issue as @OdifYltsaeb
gapi.signin2.render consistently return popup_closed_by_user when authentication completes in Chrome, but It works fine If you use a new incognito window. I use multiple google accounts with saved credentials and none seem to work. I'm using the sample code from here https://developers.google.com/identity/sign-in/web/build-button and get the same result running from either localhost or my GCP App Engine.

[daveteu]

Anyone with answers or workaround to this?

[liamcharmer]

Whats the solution for localhost?

[luisfn]

On my case, it was some type of issue with my OAuth Id I think. Just tried with a different one, from another account and didn't get the error anymore

PS: Was using Firefox 82.0 (64-bit) on Ubuntu 20.04

[accolver]

For me it was the wrong OAuth Client ID. Firebase had created a separate OAuth consent screen from my initial manual one. I just had to switch out the Client ID.