oauth-2.0google-oauthawesomium

OAuth requests to Google in embedded browsers


In the coming months, Google will no longer allow OAuth requests in embedded browsers. In our projects we are using Awesomium as a web component and I actually do not know If this change will also affect our services. Google says:

Starting October 20, 2016, we will prevent new OAuth clients from using web-views on platforms with a viable alternative, and will phase in user-facing notices for existing OAuth clients.

Now I do not see any user-facing notices. Could anyone tell me how them looks like? How can I test my services if they are ready?


Solution

  • Currently we're only seeing them in iOS embedded views on Google's "consent page." The consent page is where you have accept the application's request to access your Google user information.

    The blog post you cited above has been updated to say, "On March 1, 2017 we will post the same notification on the Android consent page."

    We've been able to simulate it internally by spoofing the user-agent from the web views.

    FWIW, the page also indicates this is going to break for macOS and Windows applications too, but there's no indication of any dates for messaging.

    Here's a sample image of the messaging:

    Google embedded browser OAuth notice