signInWithPopup issue with Firefox and beforeSignIn blocking function #6956

silas · 2023-01-19T04:04:12Z

Describe your environment

Operating System version: MacOS 13.1
Browser version: Firefox 109.0
Firebase SDK version: 9.15.0
Firebase Product: auth

Describe the problem

When signInWithPopup is used with Firefox (couldn't reproduce in Chrome or Safari) and there is a beforeSignIn blocking function that takes longer than ~2 seconds to execute the signInWithPopup call will throw the auth/popup-closed-by-user error.

Steps to reproduce:

Checkout the POC code from here
Edit the initializeApp call in public/index.html to contain valid settings
Deploy to a project that has Authentication with Identity Platform enabled
Ensure Google sign-in method is enabled
Go to <YOUR-NAME>.firebaseapp.com in Firefox and click Sign in with Google
Notice the alert Firebase: Error (auth/popup-closed-by-user).
Disable the beforeSignIn blocking function via Authentication -> Settings -> Blocking functions
Notice that it works

Relevant Code:

Blocking function

const { runWith } = require("firebase-functions");

exports.beforeSignIn = runWith({ memory: "128MB" })
  .auth.user()
  .beforeSignIn(async (user, context) => {
    await new Promise((resolve) => {
      setTimeout(resolve, 3000);
    });
  });

HTML

<!DOCTYPE html>
<html>
  <body>
    <form id="signIn">
      <button type="submit">Sign in with Google</button>
    </form>

    <script type="module">
      import { initializeApp } from "https://www.gstatic.com/firebasejs/9.15.0/firebase-app.js";
      import {
        GoogleAuthProvider,
        getAuth,
        signInWithPopup,
      } from "https://www.gstatic.com/firebasejs/9.15.0/firebase-auth.js";

      const app = initializeApp({
        appId: "<APP-ID>",
        apiKey: "<API-KEY>",
        authDomain: "<NAME>.firebaseapp.com",
        projectId: "<PROJECT-ID>",
      });
      const auth = getAuth(app);

      document.getElementById("signIn").addEventListener("submit", (event) => {
        event.preventDefault();

        signInWithPopup(auth, new GoogleAuthProvider())
          .then((result) => {
            alert("OK");
          }).catch((error) => {
            alert(error.message);
          });
      });
    </script>
  </body>
</html>

Quickly looking through the js-sdk code, there seems to be a 2 second timeout here, which might be related:

firebase-js-sdk/packages/auth/src/platform_browser/strategies/popup.ts

Line 291 in 49ee786

}, _Timeout.AUTH_EVENT);

firebase-js-sdk/packages/auth/src/platform_browser/strategies/popup.ts

Line 52 in 49ee786

AUTH_EVENT = 2000

Logs:

[2023-01-19T04:08:41.573Z]  @firebase/auth: Auth (9.15.0): INTERNAL ASSERTION FAILED: Pending promise was never set
[2023-01-19T04:08:41.575Z]  @firebase/auth: Auth (9.15.0): INTERNAL ASSERTION FAILED: Pending promise was never set
Uncaught (in promise) Error: INTERNAL ASSERTION FAILED: Pending promise was never set
    K instantiator.ts:31
    $ instantiator.ts:34
    reject abstract_popup_redirect_operation.ts:136
    onAuthEvent abstract_popup_redirect_operation.ts:113
    sendToConsumer auth_event_manager.ts:105
    onEvent auth_event_manager.ts:69
    onEvent auth_event_manager.ts:67
    initAndGetManager popup_redirect.ts:137
    lm cb=gapi.loaded_0:232
    mm cb=gapi.loaded_0:232
    Gk cb=gapi.loaded_0:209
    Pk cb=gapi.loaded_0:209
    jk cb=gapi.loaded_0:210
    TD cb=gapi.loaded_0:203
    qe cb=gapi.loaded_0:107
    re cb=gapi.loaded_0:107
    pk cb=gapi.loaded_0:202
    <anonymous> cb=gapi.loaded_0:213
    Za api.js:26
    Ya api.js:29
    Za api.js:26
    za api.js:28
    D api.js:28
    v api.js:29
    ca api.js:29
    <anonymous> cb=gapi.loaded_0:1
instantiator.ts:31:45

The text was updated successfully, but these errors were encountered:

prameshj · 2023-01-23T19:40:54Z

The popup closed error is thrown from here -

firebase-js-sdk/packages/auth/src/platform_browser/strategies/popup.ts

Line 282 in b6c231a

if (this.authWindow?.window?.closed) {

, if the window becomes closed. I suspect Firefox might be causing this to become true, if it senses the popup to be unresponsive somehow.

We will try to repro with the attached snippet(thanks!), but it might be a browser-specific behavior that we might not be able to detect/control in the SDK.

benjichat · 2023-02-20T02:51:40Z

Firebase SDK version: 9.15.0
MacOS: 13.1

I have been able to reproduce this error using chrome v 107.0.5304.87

When I updated to v 110.0.5481.100 - the error went away.

Not sure if this is helpful - it's one data point more

tanuj101 · 2023-03-05T12:07:08Z

any updates on this?

prameshj · 2023-03-06T19:00:09Z

Thanks for the update. Are we still seeing this in the latest Firefox 110?

As mentioned above, the SDK gets a popup closed event and reacts to it, so it likely has a browser interaction at play here.

silas · 2023-03-07T00:05:28Z

@prameshj Yes, I'm still seeing this issue.

It seems like this might be an issue in /__/auth/handler.

After a little debugging I found this to be the current series of events:

Initiate login via popup
Popup window is shown
User completes oauth flow
Popup window redirects to /__/auth/handler
Popup window immediately closes after redirect
POST to https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp is executed from the main window (this is the slow call)
Popup strategy times out and error is thrown
POST to https://identitytoolkit.googleapis.com/v1/accounts:lookup succeeds
User is signed in

If I monkey patch the javascript environment during the execution of /__/auth/handler to disable window.close (e.g. window.close = function() {}) the popup window isn't closed.

This leads me to believe that the close event is being called by some code in /__/auth/handler.

It'd be interesting for someone with access to that code to see if there are any cases where it will close immediately or in the event of specific failures (e.g. the gapi iframe stuff isn't working, Firefox specific code paths, etc...).

silas · 2023-03-07T00:18:07Z

Haha, yeah, so when I installed https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ and just changed my user agent to Chrome it worked fine... 😢

So definitely some Firefox specific code path.

prameshj · 2023-03-11T01:07:36Z

Interesting.. thanks for sharing this.

There isn't any user agent specific code in the /auth/handler.

Popup window redirects to /__/auth/handler

Popup window immediately closes after redirect

Can you share the full URL to /__/auth/handler in the 2 cases? Thanks!

silas · 2023-03-11T17:26:13Z

Can you share the full URL to /__/auth/handler in the 2 cases? Thanks!

See below:

Popup window redirects to /__/auth/handler

https://{APP_NAME}.firebaseapp.com/__/auth/handler?apiKey={API_KEY}&appName=%5BDEFAULT%5D&authType=signInViaPopup&redirectUrl=https%3A%2F%2F{APP_NAME}.firebaseapp.com%2F%3F&v=9.15.0&eventId=8661282041&providerId=google.com&customParameters=%7B%22prompt%22%3A%22select_account%22%7D&scopes=profile

Popup window immediately closes after redirect

https://{APP_NAME}.firebaseapp.com/__/auth/handler?state={STATE}&code={CODE}&scope=email+profile+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&authuser=0&prompt=none

silas · 2023-03-12T18:03:48Z

The window is definitely getting closed in handler.js. You can use Chrome to fake a Firefox user-agent and add a Window.close breakpoint see this.

Install User-Agent Switcher
Create a using the following settings:
- New User-agent name: Mac Firefox 110
- New User-Agent String: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
- Group: Firefox
- Append?: Replace
- Indicator Flag: FFM
Switch to Mac Firefox 110 user agent
Go through provided POC
When the popup window appears to select the Google account, open the Developer tools
Click Sources -> Event Listener Breakpoints -> Window -> Window.close
Select the Google account and see the section of code that closes the window in handler.js

Someone with access to the source map should then be able to fairly quickly figure out what's going on.

prameshj · 2023-03-13T23:49:04Z

Thanks for the detailed analysis Silas! I wasn't able to go through the steps you provided, but I looked through the code and yes, we have some legacy SDK codepaths where the popup is closed by auth/handler and there is special case for Firefox. I believe this was because Firefox does not provide the opener with permissions to close the popup (or was the case few versions back).

So, the auth/handler sends an AuthEvent and closes the popup. Meanwhile the main window, listens for AuthEvent and also polls for user cancellation in -

firebase-js-sdk/packages/auth/src/platform_browser/strategies/popup.ts

Line 292 in cdada6c

if (this.authWindow?.window?.closed) {

, so if the poller fires before the AuthEvent is processed, then we can end up in error. Perhaps this is exacerbated when there is a delay from blocking functions login. We can fix this by adding a longer delay in the poll function or cancelling the poll once we receive an AuthEvent. I will explore this some more. Thanks again for your detailed analysis here!

prameshj · 2023-03-20T23:23:05Z

In the above code, once the poller detects that the window has been closed (will be the case for Firefox), it waits for 2s before throwing error -

firebase-js-sdk/packages/auth/src/platform_browser/strategies/popup.ts

Line 301 in cdada6c

}, _Timeout.AUTH_EVENT);

. But if the sign in takes longer (due to blocking functions or otherwise), we will end up in this scenario. Changing this timeout to 8s should be sufficient. Sent out #7140, tested with a blocking function that sleeps for 7s.

silas · 2023-05-01T14:13:07Z

The fix went out in [email protected] and seems to have resolved the issue, so I'm going to close this issue. Thanks @prameshj for working through it!

prameshj · 2023-05-01T21:58:29Z

Thank you so much for confirming this and for your detailed investigation, @silas !

google-oss-bot added the api: auth label Jan 19, 2023

jbalidiong added the v9 label Jan 19, 2023

prameshj added the needs-info label Mar 6, 2023

google-oss-bot added needs-attention and removed needs-info labels Mar 7, 2023

silas mentioned this issue Mar 7, 2023

Error: INTERNAL ASSERTION FAILED: Pending promise was never set #7093

Closed

jbalidiong removed the needs-attention label Mar 8, 2023

prameshj added the needs-info label Mar 11, 2023

google-oss-bot added needs-attention and removed needs-info labels Mar 11, 2023

silas closed this as completed May 1, 2023

firebase locked and limited conversation to collaborators Jun 1, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

signInWithPopup issue with Firefox and beforeSignIn blocking function #6956

signInWithPopup issue with Firefox and beforeSignIn blocking function #6956

silas commented Jan 19, 2023 •

edited

Loading

prameshj commented Jan 23, 2023

Uh oh!

benjichat commented Feb 20, 2023 •

edited

Loading

Uh oh!

tanuj101 commented Mar 5, 2023

Uh oh!

prameshj commented Mar 6, 2023

Uh oh!

silas commented Mar 7, 2023 •

edited

Loading

Uh oh!

silas commented Mar 7, 2023

Uh oh!

prameshj commented Mar 11, 2023

Uh oh!

silas commented Mar 11, 2023

Uh oh!

silas commented Mar 12, 2023 •

edited

Loading

Uh oh!

prameshj commented Mar 13, 2023

Uh oh!

prameshj commented Mar 20, 2023 •

edited

Loading

Uh oh!

silas commented May 1, 2023

Uh oh!

prameshj commented May 1, 2023

Uh oh!

signInWithPopup issue with Firefox and beforeSignIn blocking function #6956

signInWithPopup issue with Firefox and beforeSignIn blocking function #6956

Comments

silas commented Jan 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Describe your environment

Steps to reproduce:

Relevant Code:

Logs:

prameshj commented Jan 23, 2023

Uh oh!

benjichat commented Feb 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tanuj101 commented Mar 5, 2023

Uh oh!

prameshj commented Mar 6, 2023

Uh oh!

silas commented Mar 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silas commented Mar 7, 2023

Uh oh!

prameshj commented Mar 11, 2023

Uh oh!

silas commented Mar 11, 2023

Uh oh!

silas commented Mar 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prameshj commented Mar 13, 2023

Uh oh!

prameshj commented Mar 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silas commented May 1, 2023

Uh oh!

prameshj commented May 1, 2023

Uh oh!

silas commented Jan 19, 2023 •

edited

Loading

benjichat commented Feb 20, 2023 •

edited

Loading

silas commented Mar 7, 2023 •

edited

Loading

silas commented Mar 12, 2023 •

edited

Loading

prameshj commented Mar 20, 2023 •

edited

Loading