[UPDATE] Google Auth Flows and WebView2

[jasonstephen15]

Google has recently made a policy update to prohibit Google OAuth requests in embedded browsers (webviews). This means that google auth flows will not be supported in WebView2.

Our short-term recommendation for a workaround is to launch the system browser and handle the auth flow there. Google’s OAuth Sample repo has an example of how to do this. This solution will work for all app types.

Longer term, our suggestion will be to use the Web Authentication Broker (WAB) API. The WAB API is a Windows API, vetted by Google, that will enable auth flows in your native applications. This API is currently UWP-only but has plans to be available in win32 and .NET as part of the WindowsAppSDK. Please follow the team’s GitHub post for updates on that. For more guidance on how to build out these auth flows visit the WAB Sample Code.

Feel free to leave any comments or questions below. Thanks!

[markismail7]

This is not a solution. I'm not blaming Microsoft for it. Google is a dictator. We need to move away from Google products. The only way we can do so, if Microsoft creates a Gmail. Until then, we are all screwed. The is could get way worse, the sign in with Google is a disaster right now. We can't use it with WebView2. When WebView2 was announced, I was so excited. A powerful, fast, updated Browser embedded to .NET Application. This has been a dream for All Microsoft Developers. And now all of sudden after less than year of it's launch. Google decided to prevent us from accessing Gmail from inside Webview2. Wow.

[GrandStrateguerre]

@markismail7
For me it's already done I don't use Google anymore. I use: https://www.qwant.com/
The only application I use that has an interest for me is Youtube mainly for knowledge sharing. I have forbidden my children to use Google and FaceBook apps.
:)
G.

[rjx-ray]

We are CEF users thinking about moving to WebView2, just waiting for #20 to be progressed.

We have faced exactly this authentication issue in CEF and after some considerable effort I managed to get an OAuth access token by spawning an external browser. from our app.
See my post at https://www.magpcss.org/ceforum/viewtopic.php?f=10&t=17457#p45389 with example code attached.

But as it explains in the post I have been unable to find any way of using the token for general web requests.

If anyone here has any ideas that would be very useful

[markismail7]

So if I use the OAuth, the user can sign in with the main browser, then once the user is signed in, the user can go back to use Webview2? It's like scratching your ear with your toe SMH. It's like we have nothing to do, but to work extra for google. Imagine every website is doing the same thing. I'm really surprised that most people are ok with it?

[jarno9981]

Rrrrrrrrr is swichtes from cef sharp to webview2 to use google login and now it breaks again i pissed off now

[jarno9981]

@markismail7 i hate the security change from google now my app loses lot of funtions 40hours of work gone now

[federicorosso1993]

Can you help me with the workaround?
I understand that I need to use Google’s OAuth API on the native browser, and I used that some months ago in a Unity3d game to access google drive and upload/download a save file, but I don't really understand how to do that to be able to be logged in in a browser-like app (my current webview2 don't really just need to access a google service like gmail or drive like in my unity game, I'm using my webview2 as a real browser so I cannot just ask to access gmail o google drive, I need to be able to navigate to any google related service and use it, like youtube).
The example use a Loopback to get the log in response but in the end it just print the response as a string, that's not a solution at all. What we really need (to call this a workaround) is to be able to set that response to the webview2 "cookies/cache/localstorage/whatever google is using to know that the browser is logged in". That's a "good" workaround.
The best workaround would be something even better... a blackbox solution where the webview2 open an edge window->make the user log in inside edge->set whatever google need to know that webview2 is logged into the webview2.

Not sure why you think WAB is a solution here... That's only a solution in the same way Oauth is a solution, when you know how to set the response into webview2 to make it know you are logged in.
Finally I have to say that I find many answer here unrealistic... I don't think any user will leave google just because of this. Still I think their security solutions are just really stupid... there is no reason why I should not be able to log in to my own application in a webview2, if the browser is not supported google should just tell you to log in with an alternative method (like the apps password or something like that). I don't really understand why I cannot even trust my own webview2 browser-like app.
Also when I made that game unity3d and used the google drive api, I was also able to do the same thing with dropbox and microsoft one drive. Dropbox was the best (the docs API is amazing), Microsoft was ok (I needed to contact you on github because the docs were not clear), Google API was the worst and behind everyone (you cannot even make a call without the client-secret even if you use PKCE while everybody else if you use PKCE do not require client-secret and that's a security problem on their Oauth call for desktop app).

PS. I think the solution on this post
#1669 (comment)
is the way to go. It will not require to write new code from the developers part (just update the webview2 to the last version) and it will actually work as a solution to the man in the middle for the log in part without removing the ability to use the webview2 as a real browser in a native apps (with all the good thing that can be made with that combination). You should really go with the "system webview" by default on the login page of google.

[markismail7]

@federicorosso1993 I did update to the latest version, still having the same issue. How did you fix it?

[federicorosso1993]

@federicorosso1993 I did update to the latest version, still having the same issue. How did you fix it?

I did not fix it. By solution I mean what should be done by Microsoft, but the problem is still there

[markismail7]

Why are we paying the price for Google's problem. When a user attempts to sign in with Google, let the Webview2 opens the Chrome Edge, then after signing in, it'll load automatically back to Webview2. That's a solution. Not make me register my app for something I'm not familiar with. This whole thing is stupid. Real Hackers don't need a browser to attack Google. SMH. I don't think it's about security.

[haiduong87]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows

I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

[federicorosso1993]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows

I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

Can you use this sample to navigate on a webview2 after the login like in a regular browser for all the Google website like Gmail and YouTube?

I would like the user to be able to use my app as a browser and only use the real browser during log in, is that possible?

I used a little of Google drive API for another project and I know how to ask the user the Auth code from an app and wait for the log in response, but after that I can only make another api call to access Google drive files with my own interface, I cannot set that token in a webview2 to make the user able to navigate in Google drive logged in.

That's the main problem to solve

[haiduong87]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows
I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

Can you use this sample to navigate on a webview2 after the login like in a regular browser for all the Google website like Gmail and YouTube?

I would like the user to be able to use my app as a browser and only use the real browser during log in, is that possible?

I used a little of Google drive API for another project and I know how to ask the user the Auth code from an app and wait for the log in response, but after that I can only make another api call to access Google drive files with my own interface, I cannot set that token in a webview2 to make the user able to navigate in Google drive logged in.

That's the main problem to solve

That's not my use case, so I haven't tested that.

But I think it's ok,

About the HttpListener, I have never used that before, may be there's firewall problem.

[federicorosso1993]

That's not my use case, so I haven't tested that.

But I think it's ok,

About the HttpListener, I have never used that before, may be there's firewall problem.

Don't really know what are you talking about for the httplistener, I don't have a problem with that in my other project. The problem is only with my last project where I use a webview2 as a browser and there is no way to log in to Google and watch YouTube videos after that in my own browser like app. If I can only make a oauth2 call to get the video Flux and watch it in my own interface that will only work for YouTube but not for Google drive or Gmail then there is no reason to use a webview in the first place. Of course I cannot only use my interface because I also need my browser to work on all website (not just Google services). It's crazy how difficult they made it just because they refuse to make an alternative for the Google log in... It's not even possible to use a password application like you can do for older outlook.

[Beej126]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows
I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

Can you use this sample to navigate on a webview2 after the login like in a regular browser for all the Google website like Gmail and YouTube?

@federicorosso1993, yes this sample works fine with webview2 and doesn't require any additional google login for gmail, youtube, etc... it's easy to confirm yourself as i have... add webview2 control (with Name="wv2") to bottom of existing window, then replace the one line that spawns external browser:

System.Diagnostics.Process.Start(authorizationRequest);

with webview2 equivalent:

wv2.Source = new Uri(authorizationRequest);

it appears the webview2 browser instance maintains full fidelity... we can hit F12 to open typical chrome debugger tools window and inspect that google's login cookies are indeed present.

@jasonstephen15 , @markismail7, @jarno9981, @64Soft, @Simon4638 - i'm mainly posting because i want to better understand what roadblocks you are running into, so i don't waste time going down a dead end for my own project...

it seems embedded browser approach is still functionally viable... so is this entirely about the change in google's policy? i.e. we're running afoul of rules if we continue to use embedded, even if it works?

maybe latest webview2 (v1.0.992.28 stable, published 2021-09-27) closed previous gaps?

[federicorosso1993]

@Beej126 thank you for trying it. I'll try to undestand how to implement it in my own app.

[jarno9981]

@Beej126 thank i am going to try to

[jarno9981]

@Beej126 still doesn't log me in only on edge browser

.
{
"sub": "100246938796268582855",
"name": "Jarno",
"given_name": "Jarno",
"picture": "https://lh3.googleusercontent.com/a-/AOh14Ghy0fzITDxtGU_GT6Qw75eTyPTDuK3yaqDXqtReiA\u003ds96-c",
"locale": "nl"
}

and returns this in the textbox of the browser

but when i try to login it says unsafe app Winforms

[jarno9981]

@Beej126

after email in external browser
shows correct api info but still not abble to login

after trying to login in email

[Beej126]

if i understand you, you're hoping that embedded webview2 login is shared with external browser... that might be possible with further effort but that's not going to work by default ... i believe they are running under separate "user profiles", i.e. a different bucket of all the browser state, cookies, etc

i misunderstood your desired scenario... what i am looking for, and what i thought you all were looking for, was that after you use webview for google oauth flow, you can also then count on the google auth login to be present under the webview for other google sites, youtube, gmail, etc

[jarno9981]

@Beej126 I want to by abble to login from winforms app that correct

[jarno9981]

when redirect url is active this shows

this is what textbox says : https://www.google.com/redirect URI: http://127.0.0.1:61965/
Listening..

[jarno9981]

this after email clicked

[Beej126]

i guess you're not doing what i said, to modify the sample to use the webview2?
i'll post a fork of the project with what i mean here in a few mins.

[Beej126]

this fork has the embedded webview tweak i'm suggesting in the wpf sample: https://github.com/Beej126/oauth-apps-for-windows

first image shows the oauth flow in the embedded webview
second image shows i can also jump right into youtube after the oauth flow (without logging in again)

[jarno9981]

@Beej126 i will try that like that your doing

[jarno9981]

returns this for me

no refresh

[vladimir-ikryanov]

JFYI: if you configure WebView2 to use the remote debugging port switch, then Google Sign won't work. We describe this in our troubleshooting guide.

[tobq]

@vladimir-ikryanov @jarno9981 is it now possible to sign in to google using an embedded (WebView2) browser?

[Beej126]

@vladimir-ikryanov @jarno9981 is it now possible to sign in to google using an embedded (WebView2) browser?

yes i've been doing this for months now with solid results.
my code is here => https://github.com/Beej126/GenericWebAppWpfWrapper
pay particular attention to these methods and comments: one, two

[tobq]

@vladimir-ikryanov @jarno9981 is it now possible to sign in to google using an embedded (WebView2) browser?

yes i've been doing this for months now with solid results. my code is here => https://github.com/Beej126/GenericWebAppWpfWrapper pay particular attention to these methods and comments: one, two

It seems the main change required is changing the user-agent? What is the value of that user-agent property you're using (I'm not using C# so can't check)

[Beej126]

(i heavily edited my initial response once i'd had a good night's rest =)

i found a little orchestration necessary for it to work well for me... two main things:

1. when the navigated url host becomes "accounts.google.com" (i.e. google's login page), as odd as it seems, we must set the user-agent to something BOGUS; i literally have it as "could-be-anything"... otherwise for all other urls its best to have user-agent as a legit string (there's a page ref with these standard strings in my comments)

2. if i remember correctly, the navigation flow for accounts.google.com would initiate a new browser window and i found it necessary to prevent that from happening by trapping the WebView2 new window event and instead supplying that url to the existing window... this is the only way i could successfully control the user-agent at the right time and it worked well for my interests as i prefer not to have login popups anyway

this is what i got working through trial and error but it feels like there could be other ways if there's willpower to walk through trapping all the various events to refine alternatives.

i'll go ahead and mention, every once in a while i'll lose my login context with gmail and i'll have to re-login, this seems pretty typical even in normal browser operation... right after successful login, google presents an interesting page something to the effect of "would you like to continue to the modern gmail page or the old html only one"... i believe this comes from them reading the nonstandard user-agent and assuming that means you're running in a low end browser... it's no harm, i just pick the modern gmail option and off it goes just fine... to me even seeing this dialog is an interesting space to explore sometime... it is a really powerful idea for us to be able to insert our logic in the middle of all these hosted pages and influence what happens to create something more catered to our individual preferences.

[hershkoy]

For those who managed to login, are you experiencing random log out from the gmail session?
We managed to do login with the user agent solution, but after some time, the gmail session is logged out. I really would appreciate to know if there is a solution for this (or to know if I am the only one experiencing it)

[mikeduglas]

I haven't experienced logging out of my Gmail session.

…

-- Mike чт, 18 авг. 2022 г. в 21:11, hershkoy ***@***.***>:

For those who managed to login, are you experiencing random log out from the gmail session? We managed to do login with the user agent solution, but after some time, the gmail session is logged out. I really would appreciate to know if there is a solution for this (or to know if I am the only one experiencing it) — Reply to this email directly, view it on GitHub <#1647 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC5IURKX56UPY57XSQRBWK3VZZ4GNANCNFSM5CEAQZIA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Beej126]

it stays logged in for multiple days for me... every once in a while i'll notice i have to log back in but it's very infrequent

[vladimir-ikryanov]

@Beej126 same in my case. I keep my Gmail tab open 24/7 and from time to time (once a week) Google asks me to log in again.

[JohnDizzle]

From deployment I use a UserAgent = "Chrome", and save it to my Settings, and then login to google. I change UserAgent (To Chrome's Current UserAgen) in my Settings and then restart app and all is fine.

[Vladoses]

hello, still no normal solution to this problem? if there is a solution, can you tell me where

[jarno9981]

yeah first google is blocking webview2 now external companies with websites are blocking webview2

on edge or chrome the website works fine

[ivfit]

What happens when you remove "Edg/..." part from the WebView2 user agent?

[jarno9981]

What happens when you remove "Edg/..." part from the WebView2 user agent?

No idea try it

[champnic]

@jarno9981 That coolblue.nl website worked fine for me from a couple of WebView2 apps.

[jarno9981]

@jarno9981 That coolblue.nl website worked fine for me from a couple of WebView2 apps.

For me it gets blocked and on edge en chrome it works fine

[untitledcade]

google login works for me, maybe webview2 updated?

[jarno9981]

google login works for me, maybe webview2 updated?

Does it work without any workaround @t1soft

[jarno9981]

@jarno9981 That coolblue.nl website worked fine for me from a couple of WebView2 apps.

@champnic was my mistake the useragent was messed up

[untitledcade]

google login works for me, maybe webview2 updated?

Does it work without any workaround @t1soft

@jarno9981 From my experience, it does work, however I don't know if others can log in without workaround

On two computers, I was able to log into google through webview2 without using any workaround. Gmail works alright, have yet to experience random log-outs.