Google Sign-In API Hang with uncaught error Failed to get parent origin from URL hash

Question

I\'m using Google Sign-In JavaScript client for months without problem. But recently when user tapping on sign in button from webapp that added to homescreen, the signin pop

Answer 1

My electron app started to fail today for the same reason. Been debugging quite a lot and I think found the reason, but don't know how to solve it, why it happened, or if it is electron or google's fault.

In my electron app, I have 2 webviews, one for the main content and another one for google popup dialogs.

So when google needs to open the authentication, it generates this IFRAME:

    <iframe id="ssIFrame_google" 
                sandbox="allow-scripts allow-same-origin" aria-hidden="true" 
                src="https://accounts.google.com/o/oauth2/iframe#origin=https%3A%2F%2Fxxxx.com&amp;rpcToken=dxxd318480305.4777704" 
                style="... display: none;"></iframe>

Mind that the URL has HASH parameters: your origin and the token.

However, when on the electron side I capture the new-window event in order to open the URL myself in another webview, the event I receive LACKS the hash parameters:

event { 
  type : "new-window",
  url:"https://accounts.google.com/o/oauth2/iframe",
  .
  .
}

So what google's iframe is complaining about (I debugged it) is exactly that it can't find the origin and rpctoken parameters that should be in the hash parameters.

For a reason I don't understand (I haven't updated electron) the new-window event does not receive the full url anymore.

Using @howMuchCheeseIsTooMuchCheese answer below I have changed the flow to use the redirect callback, then capture that callback myself and restart the application. It is not ideal, but at least I can login into my applications.

Answer 2

I can confirm we are experiencing the same problems at my company since recently. It seems a bit erratic, not 100% of the time. But for some users, some time, they are met with an empty sign-in popup with the url pointing to "https://accounts.google.com/o/oauth2/iframe" but nothing happens.

Answer 3

Not a complete answer yet, but this may be a reasonable workaround for some. I updated the ux_mode to use redirect and it is partially working now.

auth2 = gapi.auth2.init({
    client_id: '1234.apps.googleusercontent.com',
    scope: 'profile email',
    ux_mode: 'redirect',
    redirect_uri: 'https://blahblah.io/oauth2callback'
})

NOTE: it seems redirect_uri is required, contrary to Google's docs. This isn't a perfect drop-in replacement, but it solves the "URL hash!" error

This blog post and the Git Repo in it could also be helpful for anyone attempting to use redirect