You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Console Error appears when signing in with Google Sign In (Cross-Origin-Opener-Policy) #25427
Console Error appears saying `Cross-Origin-Opener-Policy policy would block the window.postMessage call.
Expected Result:
Describe what you think should've happened
User should be able to sign in with Google without encountering console error. However, this does not prevent the user from signing in.
Actual Result:
Describe what actually happened
User signs in successfully, but with a console error.
Workaround:
Can the user still use Expensify without this being fixed? Have you informed them of the workaround?
Yes. This is not a blocking issue. Only a console error appears.
Platforms:
Which of our officially supported platforms is this issue occurring on?
Android / native
Android / Chrome
iOS / native
iOS / Safari
MacOS / Chrome / Safari
MacOS / Desktop
Version Number: TBD Reproducible in staging?: TBD Reproducible in production?: TBD If this was caught during regression testing, add the test name, ID and link from TestRail: N/A Email or phone of affected tester (no customers): N/A Logs:https://stackoverflow.com/c/expensify/questions/4856 Notes/Photos/Videos: Any additional supporting documentation
This is likely to be an issue stemming from Google's GSI service. There is a way to fix it on the back end by specifying the Cross-Origin-Opener-Policylike so. We anticipate to this to resolve on it's own, but to not have multiple issues being opened for this we preemptively opened this tracking issue. Expensify/Expensify Issue URL:Tracking Issue Issue reported by:@cdanwards Slack conversation: N/A
@cdanwards@marcochavezf@0xmiroslav - tagging you all from the related project tracker on what we're doing with this issue and who's taking responsibility for it :)
@trjExpensify sorry for the delayed response! I thought it might be valuable to provide a bit more detail from the discussion on the original PR where @lindboeexplained:
Would it be related to CSP? I remember we had an issue with the Apple cdn with the Apple sign-in, I wonder if we should add something similar
No, it's an overly-eager verification error on Google's end. What Google says in their docs is to ensure you don't use same-origin as the value for the Cross-Origin-Opener-Policy header, and to instead use same-origin-allow-popups. The Expensify app isn't doing this, it isn't setting it at all, and the default value (unsafe-none) is more permissive than all of the options. So the client library is erroneously warning this won't work because it's not set to same-origin-allow-popups, but unsafe-none will allow everything same-origin-allow-popups does and more.
I've looked for how to try to report this bug to Google but have not found anything.
We could add the header and change it to same-origin-allow-popups like we did with CSP, and that would fix the warning, but it could potentially break something else.
We've also noticed that even since that discussion the Google docs have continued to change regarding COOP.
Ultimately, Expensify is currently set up with a policy that is less restrictive than Google suggests, but adding more restrictions might inadvertently break other features.
So my read is that this is a new feature and the project team are keeping ahold of it. As such, I'm going to assign it to Marco and mark is as internal. If you are moving this on to work on, feel free to assign me back to it.
This issue has not been updated in over 15 days. @marcochavezf eroding to Monthly issue.
P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!
Activity
melvin-bot commentedon Aug 17, 2023
Triggered auto assignment to @trjExpensify (
Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.melvin-bot commentedon Aug 17, 2023
Bug0 Triage Checklist (Main S/O)
Platformsin OP are ✅)trjExpensify commentedon Aug 17, 2023
👋 @cdanwards are you taking this issue on as part of that project?
melvin-bot commentedon Aug 21, 2023
@trjExpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!
trjExpensify commentedon Aug 21, 2023
@cdanwards @marcochavezf @0xmiroslav - tagging you all from the related project tracker on what we're doing with this issue and who's taking responsibility for it :)
cdanwards commentedon Aug 23, 2023
@trjExpensify sorry for the delayed response! I thought it might be valuable to provide a bit more detail from the discussion on the original PR where @lindboe explained:
We've also noticed that even since that discussion the Google docs have continued to change regarding COOP.
Ultimately, Expensify is currently set up with a policy that is less restrictive than Google suggests, but adding more restrictions might inadvertently break other features.
trjExpensify commentedon Aug 23, 2023
Thanks, @cdanwards.
So my read is that this is a
new featureand the project team are keeping ahold of it. As such, I'm going to assign it to Marco and mark is asinternal. If you are moving this on to work on, feel free to assign me back to it.31 remaining items
marcochavezf commentedon Nov 30, 2023
No update
melvin-bot commentedon Dec 25, 2023
This issue has not been updated in over 15 days. @marcochavezf eroding to Monthly issue.
P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!
marcochavezf commentedon Jan 29, 2024
No update
marcochavezf commentedon Mar 1, 2024
No update
marcochavezf commentedon Mar 21, 2024
Closing it for now since it's not impacting the app functionality or users.