Google blocks login from nativefier app, unless setting userAgent to non-Chrome browser

[thehunmonkgroup]

EDIT from maintainer @ronjouch see comments below, the workaround as of March 2020 is to lie about the userAgent, for example passing --user-agent "Mozilla/5.0 (Windows NT 10.0; rv:74.0) Gecko/20100101 Firefox/74.0" . It would be cool to do that automatically on opening / navigating to an accounts.google.com page, PR welcome.

---

Description

I've created a nativefier app for https://contacts.google.com, and it installs just fine, but Google seems to be blocking the initial login with this message:

You're using a browser that Google doesn't recognize or that's set up in a way we don't support.
To keep your Google Account secure, sign in on another browser or change your browser's settings.

My older nativefier apps pointed to Google services are still loading OK, I'm guessing because the login is already saved and Google isn't blocking things at that stage.

I'll note that I also tried another desktop app generator (https://github.com/quanglam2807/webcatalog), and the same issue is occurring, so perhaps there's some deeper fix needed at the Electron level or something?

Steps to reproduce issue

1. Create the app with the command below
2. Try to log into Google
3. Get the message listed above

Details

• Are you nativefying a public website? Yes
• Feature request? Have you looked at nativefier --help to see if an existing option could fit your needs? Yes
• Full nativefier command used to build your app: nativefier --electron-version 6.0.2 --name "Google Contacts" --icon "/home/hunmonk/Pictures/icons/google-contacts.png" --internal-urls "contacts.google.*?" --single-instance "https://contacts.google.com"
• Version of Nativefier (run nativefier --version): v7.6.12
• Version of node.js (run node --version): v10.15.2
• OS: Ubuntu 19.04
• Error message / stack trace (if any): None

[mxdpeep]

this is a well known issue:

Google will no longer allow OAuth requests to Google in embedded browsers. "On April 20, 2017, we will start blocking OAuth requests using web-views for all OAuth clients on platforms where viable alternatives exist." We received this notice. In our iOS app using the Google drive, but google drive sdk no updated.

[mxdpeep]

more information: https://stackoverflow.com/questions/41705752/google-oauth-electron-webview-deprecation

[mxdpeep]

Google solutions: https://developers.google.com/identity/protocols/OAuth2InstalledApp

[mxdpeep]

you cannot electronize Google's original apps anymore -> deal with it, it's forbidden

[UndarkAido]

Weird, it still works fine for me.

[thehunmonkgroup]

It works for me on installations that I had logged into previously, but not newly created applications.

[UndarkAido]

I can do it on new applications

[thehunmonkgroup]

@Aidoboy are you using 2-factor authentication?

Further testing seems to confirm that the issue only occurs with 2-factor authentication enabled on the Google account.

If this is in fact the limitation, I wonder if there are any practical workarounds besides completely disabling 2-factor authentication?

[mxdpeep]

it's not 2FA related

any app trying to reach out to Google OAuth login page will open an external browser window

installed apps must open the system browser and supply a local redirect URI to handle responses from Google's authorization server

[UndarkAido]

It's working for me with 2FA

…

On Tue, Sep 3, 2019, 3:13 AM Filip Oščádal ***@***.***> wrote: it's not 2FA related *any app trying to reach out to Google OAuth login page will open an external browser window* installed apps must open the system browser and supply a local redirect URI to handle responses from Google's authorization server — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#831>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYT6YRPQHMPE7TOHF2FL5TQHYMCDANCNFSM4IMNW2VQ> .

[simone-pignotti]

It's working with 2FA for me too. I use --internal-urls "(.*?contacts\.google\.com.*?|.*?accounts\.google\.com.*?)".
EDIT: see also #706

[thehunmonkgroup]

This must have been a temporary issue on the Google end, as I just tried the original nativefier app recently, and it's logging in just fine now.

[mxdpeep]

This must have been a temporary issue on the Google end, as I just tried the original nativefier app recently, and it's logging in just fine now.

https://security.googleblog.com/2019/04/better-protection-against-man-in-middle.html

note:

Because we can’t differentiate between a legitimate sign in and a MITM attack on these platforms, we will be blocking sign-ins from embedded browser frameworks starting in June 2019.

[mxdpeep]

nativefier --electron-version 7.1.2 --name "Google Contacts" --internal-urls "contacts.google.*?" --single-instance "https://contacts.google.com"

this works perfectly