@@ -350,12 +350,22 @@ function register(ctx) {
350350 wc . setWindowOpenHandler ( ( { url, disposition } ) => {
351351 log ( '[Browser] window.open intercepted:' , url , 'disposition:' , disposition ) ;
352352
353- // Google auth — allow as popup so OAuth tokens stay in the webview's session
354- // (opening in system browser breaks gcloud login, Google Drive, Colab auth flows)
355- if ( url . includes ( 'accounts.google.com' ) ||
356- url . includes ( 'accounts.youtube.com' ) ||
357- url . includes ( 'myaccount.google.com' ) ) {
358- log ( '[Browser] Allowing Google auth popup in-app for OAuth flow' ) ;
353+ // SSO/OAuth auth flows — allow as popup so tokens stay in the webview's session
354+ const AUTH_PATTERNS = [
355+ 'accounts.google.com' , 'accounts.youtube.com' , 'myaccount.google.com' ,
356+ 'login.microsoftonline.com' , 'login.live.com' , 'login.windows.net' ,
357+ 'github.com/login' , 'github.com/sessions' ,
358+ 'auth0.com' , 'okta.com' , 'onelogin.com' ,
359+ 'sso.' , '/oauth' , '/auth/' , '/login' , '/signin' , '/saml' ,
360+ 'appleid.apple.com' , 'idmsa.apple.com' ,
361+ 'api.twitter.com/oauth' , 'x.com/i/oauth' ,
362+ 'facebook.com/v' , 'facebook.com/dialog' ,
363+ 'linkedin.com/oauth' ,
364+ 'contacts.google.com/widget' , 'apis.google.com' ,
365+ 'plus.google.com' , 'drive.google.com' ,
366+ ] ;
367+ if ( AUTH_PATTERNS . some ( p => url . includes ( p ) ) ) {
368+ log ( '[Browser] Allowing auth/SSO popup in-app:' , url ) ;
359369 return { action : 'allow' } ;
360370 }
361371
@@ -369,14 +379,6 @@ function register(ctx) {
369379 return { action : 'deny' } ;
370380 }
371381
372- // Google widgets (contacts hovercard, etc.) - allow as popups
373- if ( url . includes ( 'contacts.google.com/widget' ) ||
374- url . includes ( 'apis.google.com' ) ||
375- url . includes ( 'plus.google.com' ) ||
376- url . includes ( 'drive.google.com' ) ) {
377- return { action : 'allow' } ;
378- }
379-
380382 // about:blank or empty URLs: sites like Google Drive call window.open('')
381383 // then set the popup's location. We can't capture the final URL from here,
382384 // so allow it and intercept navigation on the created window.
0 commit comments