[UPDATE] Google Auth Flows and WebView2

[jasonstephen15]

Google has recently made a policy update to prohibit Google OAuth requests in embedded browsers (webviews). This means that google auth flows will not be supported in WebView2.

Our short-term recommendation for a workaround is to launch the system browser and handle the auth flow there. Google’s OAuth Sample repo has an example of how to do this. This solution will work for all app types.

Longer term, our suggestion will be to use the Web Authentication Broker (WAB) API. The WAB API is a Windows API, vetted by Google, that will enable auth flows in your native applications. This API is currently UWP-only but has plans to be available in win32 and .NET as part of the WindowsAppSDK. Please follow the team’s GitHub post for updates on that. For more guidance on how to build out these auth flows visit the WAB Sample Code.

Feel free to leave any comments or questions below. Thanks!

[markismail7]

This is not a solution. I'm not blaming Microsoft for it. Google is a dictator. We need to move away from Google products. The only way we can do so, if Microsoft creates a Gmail. Until then, we are all screwed. The is could get way worse, the sign in with Google is a disaster right now. We can't use it with WebView2. When WebView2 was announced, I was so excited. A powerful, fast, updated Browser embedded to .NET Application. This has been a dream for All Microsoft Developers. And now all of sudden after less than year of it's launch. Google decided to prevent us from accessing Gmail from inside Webview2. Wow.

[GrandStrateguerre]

@markismail7
For me it's already done I don't use Google anymore. I use: https://www.qwant.com/
The only application I use that has an interest for me is Youtube mainly for knowledge sharing. I have forbidden my children to use Google and FaceBook apps.
:)
G.

[rjx-ray]

We are CEF users thinking about moving to WebView2, just waiting for #20 to be progressed.

We have faced exactly this authentication issue in CEF and after some considerable effort I managed to get an OAuth access token by spawning an external browser. from our app.
See my post at https://www.magpcss.org/ceforum/viewtopic.php?f=10&t=17457#p45389 with example code attached.

But as it explains in the post I have been unable to find any way of using the token for general web requests.

If anyone here has any ideas that would be very useful

[markismail7]

So if I use the OAuth, the user can sign in with the main browser, then once the user is signed in, the user can go back to use Webview2? It's like scratching your ear with your toe SMH. It's like we have nothing to do, but to work extra for google. Imagine every website is doing the same thing. I'm really surprised that most people are ok with it?

[jarno9981]

Rrrrrrrrr is swichtes from cef sharp to webview2 to use google login and now it breaks again i pissed off now

[jarno9981]

@markismail7 i hate the security change from google now my app loses lot of funtions 40hours of work gone now

[federicorosso1993]

Can you help me with the workaround?
I understand that I need to use Google’s OAuth API on the native browser, and I used that some months ago in a Unity3d game to access google drive and upload/download a save file, but I don't really understand how to do that to be able to be logged in in a browser-like app (my current webview2 don't really just need to access a google service like gmail or drive like in my unity game, I'm using my webview2 as a real browser so I cannot just ask to access gmail o google drive, I need to be able to navigate to any google related service and use it, like youtube).
The example use a Loopback to get the log in response but in the end it just print the response as a string, that's not a solution at all. What we really need (to call this a workaround) is to be able to set that response to the webview2 "cookies/cache/localstorage/whatever google is using to know that the browser is logged in". That's a "good" workaround.
The best workaround would be something even better... a blackbox solution where the webview2 open an edge window->make the user log in inside edge->set whatever google need to know that webview2 is logged into the webview2.

Not sure why you think WAB is a solution here... That's only a solution in the same way Oauth is a solution, when you know how to set the response into webview2 to make it know you are logged in.
Finally I have to say that I find many answer here unrealistic... I don't think any user will leave google just because of this. Still I think their security solutions are just really stupid... there is no reason why I should not be able to log in to my own application in a webview2, if the browser is not supported google should just tell you to log in with an alternative method (like the apps password or something like that). I don't really understand why I cannot even trust my own webview2 browser-like app.
Also when I made that game unity3d and used the google drive api, I was also able to do the same thing with dropbox and microsoft one drive. Dropbox was the best (the docs API is amazing), Microsoft was ok (I needed to contact you on github because the docs were not clear), Google API was the worst and behind everyone (you cannot even make a call without the client-secret even if you use PKCE while everybody else if you use PKCE do not require client-secret and that's a security problem on their Oauth call for desktop app).

PS. I think the solution on this post
#1669 (comment)
is the way to go. It will not require to write new code from the developers part (just update the webview2 to the last version) and it will actually work as a solution to the man in the middle for the log in part without removing the ability to use the webview2 as a real browser in a native apps (with all the good thing that can be made with that combination). You should really go with the "system webview" by default on the login page of google.

[markismail7]

@federicorosso1993 I did update to the latest version, still having the same issue. How did you fix it?

[federicorosso1993]

@federicorosso1993 I did update to the latest version, still having the same issue. How did you fix it?

I did not fix it. By solution I mean what should be done by Microsoft, but the problem is still there

[markismail7]

Why are we paying the price for Google's problem. When a user attempts to sign in with Google, let the Webview2 opens the Chrome Edge, then after signing in, it'll load automatically back to Webview2. That's a solution. Not make me register my app for something I'm not familiar with. This whole thing is stupid. Real Hackers don't need a browser to attack Google. SMH. I don't think it's about security.

[haiduong87]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows

I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

[federicorosso1993]

Here's a practice from gg.
https://github.com/googlesamples/oauth-apps-for-windows

I can't point the different between my own way and this suggestion.
I'm doing as:

• Show a webiview2 web login page
• Handle navigating events to grab the key
• Call rest api to get token

Can you use this sample to navigate on a webview2 after the login like in a regular browser for all the Google website like Gmail and YouTube?

I would like the user to be able to use my app as a browser and only use the real browser during log in, is that possible?

I used a little of Google drive API for another project and I know how to ask the user the Auth code from an app and wait for the log in response, but after that I can only make another api call to access Google drive files with my own interface, I cannot set that token in a webview2 to make the user able to navigate in Google drive logged in.

That's the main problem to solve