Android Google sign in warning

Viewed 201

Hello to all of you guys.

Today I received the following warning from Google to my inbox :

We are writing to let you know that Google will discontinue support for sign-ins to Google accounts from embedded browser frameworks, starting January 4, 2021. We have detected the use of an embedded browser framework with one or more of your OAuth clients that may be blocked on or after January 4, 2021. Please review your use of Google Account authorization flows in the following Google OAuth client IDs and make any required changes before January 4, 2021...

In my project, I am using the official google sign-in library to authenticate a user and retrieve user's account and token. When user is logged in and token is successfully retrieved, token is send to backend server in order to generate the access & refresh token as described in the OAuth2 flow.

My question is, is there a conflict using both these flows to finally generate an access token for the user? If not, do you have any ideas where I should focus to locate and fix the problem? As the warning says, I am not using any embedded browser login functionallity so my concirns are on the previously described case.

Thank you in advance!

1 Answers

Google's recommendation for some time has been for mobile apps to follow the AppAuth pattern, where the app itself never sees the user's credentials and a Chrome Custom Tab is used for logins.

If you are interested in evaluating this option there are a couple of code samples from my blog that you can easily run. It is quite a difficult flow to implement though.

Related