When Google One Tap is used on a website and if the user has signed in to Google before loading the web page, the user is presented with a consent and sign-in dialog including information about his/her Google session(s) (email address, profile picture, etc.), even if the user visits the website for the first time.
How does it work? How does Google get the user identity on the third party website to display the correct session information? Does it rely on a third-party cookie? If yes, which one?
Google one tap relies on iframe & cookies. Since the iframe origin points to google the cookies will be accessible within the iframe once it's load. So when you click on sign-in a request is made to sign you in and return a JWT. check this article to learn more.
However, there is one missing piece that I don't understand, which was how does that JWT get passed to the parent frame. In Oauth you would get redirected to the Authorized/domain/path and the JWT will be passed there.
But in my testing of google one tap there is no redirect or refresh of any kind (at least nothing that I noticed). I know that the google one tap client takes a callback which you can use to react to the response of the authentication request, but have no idea how does the callback gets the JWT from the iframe
