Skip to content

Console Error appears when signing in with Google Sign In (Cross-Origin-Opener-Policy) #25427

Closed

Description

@cdanwards

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!


Action Performed:

Break down in numbered steps

  1. Sign in with Google.
  2. Console Error appears saying `Cross-Origin-Opener-Policy policy would block the window.postMessage call.

Expected Result:

Describe what you think should've happened

User should be able to sign in with Google without encountering console error. However, this does not prevent the user from signing in.

Actual Result:

Describe what actually happened

User signs in successfully, but with a console error.

Workaround:

Can the user still use Expensify without this being fixed? Have you informed them of the workaround?

Yes. This is not a blocking issue. Only a console error appears.

Platforms:

Which of our officially supported platforms is this issue occurring on?

  • Android / native
  • Android / Chrome
  • iOS / native
  • iOS / Safari
  • MacOS / Chrome / Safari
  • MacOS / Desktop

Version Number: TBD
Reproducible in staging?: TBD
Reproducible in production?: TBD
If this was caught during regression testing, add the test name, ID and link from TestRail: N/A
Email or phone of affected tester (no customers): N/A
Logs: https://stackoverflow.com/c/expensify/questions/4856
Screenshot 2023-08-17 at 2 55 00 PM
Notes/Photos/Videos: Any additional supporting documentation
This is likely to be an issue stemming from Google's GSI service. There is a way to fix it on the back end by specifying the Cross-Origin-Opener-Policy like so. We anticipate to this to resolve on it's own, but to not have multiple issues being opened for this we preemptively opened this tracking issue.
Expensify/Expensify Issue URL: Tracking Issue
Issue reported by: @cdanwards
Slack conversation: N/A

View all open jobs on GitHub

Activity

  1. added
    BugSomething is broken. Auto assigns a BugZero manager.
    on Aug 17, 2023
  2. melvin-bot commented on Aug 17, 2023

    @melvin-bot

    Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

  3. melvin-bot commented on Aug 17, 2023

    @melvin-bot

    Bug0 Triage Checklist (Main S/O)

    • This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
    • This bug is not a duplicate report (check E/App issues and #expensify-bugs)
      • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
    • This bug is reproducible using the reproduction steps in the OP. S/O
      • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
      • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
    • This issue is filled out as thoroughly and clearly as possible
      • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
    • I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync
  4. trjExpensify commented on Aug 17, 2023

    @trjExpensify
    Contributor

    👋 @cdanwards are you taking this issue on as part of that project?

  5. melvin-bot commented on Aug 21, 2023

    @melvin-bot

    @trjExpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

  6. trjExpensify commented on Aug 21, 2023

    @trjExpensify
    Contributor

    @cdanwards @marcochavezf @0xmiroslav - tagging you all from the related project tracker on what we're doing with this issue and who's taking responsibility for it :)

  7. cdanwards commented on Aug 23, 2023

    @cdanwards
    ContributorAuthor

    @trjExpensify sorry for the delayed response! I thought it might be valuable to provide a bit more detail from the discussion on the original PR where @lindboe explained:

    Would it be related to CSP? I remember we had an issue with the Apple cdn with the Apple sign-in, I wonder if we should add something similar

    No, it's an overly-eager verification error on Google's end. What Google says in their docs is to ensure you don't use same-origin as the value for the Cross-Origin-Opener-Policy header, and to instead use same-origin-allow-popups. The Expensify app isn't doing this, it isn't setting it at all, and the default value (unsafe-none) is more permissive than all of the options. So the client library is erroneously warning this won't work because it's not set to same-origin-allow-popups, but unsafe-none will allow everything same-origin-allow-popups does and more.

    I've looked for how to try to report this bug to Google but have not found anything.

    We could add the header and change it to same-origin-allow-popups like we did with CSP, and that would fix the warning, but it could potentially break something else.

    We've also noticed that even since that discussion the Google docs have continued to change regarding COOP.

    Ultimately, Expensify is currently set up with a policy that is less restrictive than Google suggests, but adding more restrictions might inadvertently break other features.

  8. trjExpensify commented on Aug 23, 2023

    @trjExpensify
    Contributor

    Thanks, @cdanwards.

    So my read is that this is a new feature and the project team are keeping ahold of it. As such, I'm going to assign it to Marco and mark is as internal. If you are moving this on to work on, feel free to assign me back to it.

  9. 31 remaining items

  10. marcochavezf commented on Nov 30, 2023

    @marcochavezf
    Contributor

    No update

  11. melvin-bot commented on Dec 25, 2023

    @melvin-bot

    This issue has not been updated in over 15 days. @marcochavezf eroding to Monthly issue.

    P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!

  12. marcochavezf commented on Jan 29, 2024

    @marcochavezf
    Contributor

    No update

  13. marcochavezf commented on Mar 1, 2024

    @marcochavezf
    Contributor

    No update

  14. marcochavezf commented on Mar 21, 2024

    @marcochavezf
    Contributor

    Closing it for now since it's not impacting the app functionality or users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

MonthlyKSv2NewFeatureSomething to build that is a new item.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions