[google_sign_in] Enable FedCM for web. Use token expiration. #5225

ditman · 2023-10-25T02:10:17Z

Enables FedCM API on compatible browsers.
- The GIS JS SDK falls-back to the JS implementation on browsers that don't support the new standard. See migration instructions).
Uses the supplied token expiration information to more accurately compute isSignedIn() and canAccessScopes(scopes).
- This does not handle the case where users sign in/out in another tab or from outside the web app, that's still something that needs to be checked server-side.
Deprecates the signIn() method on the web.
- Users should migrate to a combination of renderButton() and silentSignIn(), as described here.

Issues

FedCM:
- Fixes [cocoon] Opt-in to FedCM Beta for GIS in Build Dashboard. flutter#133703 (once rebuilt/redeployed)
- Fixes b/301259123
Token expiration:
- Unblocks b/245740319

Testing

Added a few unit tests
Manually verified token expiration: https://dit-gis-test.web.app

Pre-launch Checklist

If you need help, consider asking for advice on the #hackers-new channel on Discord.

ditman · 2023-10-26T21:35:33Z

I'm awaiting confirmation from the GIS team to see if they want Flutter users to opt-in to this new API (would require a platform interface + core plugin change), or is it OK that we opt them in like this.

Internally confirmed that it's OK that we flip this switch on for our users (b/301259123#comment5). The more, the merrier.

stuartmorgan

Small comments, but otherwise LGTM

stuartmorgan · 2023-11-01T14:13:44Z

packages/google_sign_in/google_sign_in_web/lib/src/gis_client.dart

@@ -265,6 +282,8 @@ class GisSdkClient {
  // This function returns the currently signed-in [GoogleSignInUserData].
  //
  // It'll do a request to the People API (if needed).
+  //
+  // @Deprecated


Why is a private method deprecated?

I added these because I don't want to forget about removing these when actually removing the signIn method, but this should probably be an issue + proper TODO.

I'll create the issue right away and link it properly.

Linked these breadcrumbs to this issue:

[google_sign_in_web] Remove deprecated signIn method. flutter#137727

stuartmorgan · 2023-11-01T14:16:51Z

packages/google_sign_in/google_sign_in_web/lib/src/gis_client.dart

+    if (_lastCredentialResponse != null) {
+      final DateTime? expiration = utils
+          .getCredentialResponseExpirationTimestamp(_lastCredentialResponse);
+      isSignedIn = expiration?.isAfter(DateTime.now()) ?? false;


So a missing expiration field would indicate that it's already expired? Naively (not knowing the API surface) I would expect that if expiration is optional, then not having it should yield a true result here, so maybe a comment would be helpful?

I'm going to document this a little bit further, but in this case, if the CredentialResponse payload cannot be decoded, is null, or doesn't contain an "exp" claim, we assume that the token is bad, and thus the user is not authenticated.

In a valid Google ID Token, the "exp" claim should always be provided:

https://developers.google.com/identity/openid-connect/openid-connect#an-id-tokens-payload

packages/google_sign_in/google_sign_in_web/lib/src/gis_client.dart

packages/google_sign_in/google_sign_in_web/lib/src/utils.dart

stuartmorgan · 2023-11-01T14:28:15Z

packages/google_sign_in/google_sign_in_web/lib/src/utils.dart

@@ -74,10 +77,24 @@ GoogleSignInUserData? gisResponsesToUserData(
    id: payload['sub']! as String,
    displayName: payload['name'] as String?,
    photoUrl: payload['picture'] as String?,
-    idToken: credentialResponse.credential,
+    idToken: credentialResponse!.credential,


This is conceptually removed enough from the code that ensures that the ! is safe (it's in another method) that I worry about someone changing that code later and this becoming a crash. Couldn't it just be credentialResponse?.credential so it's safe, since it's a nullable field?

Yes, in this case payload != null implies credentialResponse != null but as you said, the connection is pretty vague.

I think what I really want here is an assertion that (credentialResponse?.credential != null) before returning the GoogleSignInUserData, that way I'm expressing in code that the credential must NOT be null before returning a GoogleSignInUserData.

packages/google_sign_in/google_sign_in_web/lib/src/utils.dart

ditman · 2023-11-01T21:05:58Z

Thanks for the review! I'll address the comments shortly!

…gnedIn/canAccessScopes.

ditman · 2023-11-02T01:07:06Z

I'll land this now, and talk to the Cocoon ppl.

…lutter/packages#5225)

flutter/packages@6ad40b9...33c2b4e 2023-11-02 ditman@gmail.com [google_sign_in] Enable FedCM for web. Use token expiration. (flutter/packages#5225) 2023-11-01 ditman@gmail.com [video_player_web] Listen to loadedmetadata event from video element. (flutter/packages#5289) 2023-11-01 stuartmorgan@google.com [local_auth] Update iOS to Pigeon 13 (flutter/packages#5269) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-packages-flutter-autoroll Please CC flutter-ecosystem@google.com,rmistry@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Flutter: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

* main: (59 commits) [pointer_interceptor] Move pointer_interceptor to sub folder (flutter#5291) [webview_flutter] Update iOS to Pigeon 13 (flutter#5271) [repo] Adjust error message layout for repo checks (flutter#5241) [in_app_pur]: Bump org.json:json from 20230618 to 20231013 in /packages/in_app_purchase/in_app_purchase/example/android/app (flutter#5153) Roll Flutter from f5a9835 to 5a6a322 (15 revisions) (flutter#5345) [google_sign_in_ios] Upgrade GoogleSignIn iOS SDK to 7.0 (flutter#5240) Roll Flutter from 29b2516 to f5a9835 (101 revisions) (flutter#5341) [pigeon]: Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.10 to 1.9.20 in /packages/pigeon/platform_tests/test_plugin/android (flutter#5334) [flutter_markdown] Strip leading whitespace from list items (flutter#5294) [two_dimensional_scrollables] Add borderRadius support to TableSpanDecoration (flutter#5184) [go_router] Adds an ability to add a custom codec for serializing/des… (flutter#5288) [go_router] Fixes crashes when dynamically updates routing tables wit… (flutter#5242) [camerax] Fix `_getResolutionSelectorFromPreset` NPE (flutter#5287) [go_router]Fixes the problem what pathParameters is null in redirect when the Router is recreated. (flutter#5258) [google_sign_in] Fix Obj-C formatting bug (flutter#5310) Fix mounted checks (flutter#5305) [flutter_image] [flutter_markdown] Do not use dynamic in an == operator override (flutter#5298) [google_sign_in] Enable FedCM for web. Use token expiration. (flutter#5225) [video_player_web] Listen to loadedmetadata event from video element. (flutter#5289) [local_auth] Update iOS to Pigeon 13 (flutter#5269) ... # Conflicts: # packages/webview_flutter/webview_flutter_wkwebview/ios/Classes/FWFWebViewHostApi.m

…#5225) * Enables [**FedCM API**](https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API) on compatible browsers. * The GIS JS SDK falls-back to the JS implementation on browsers that don't support the new standard. See [migration instructions](https://developers.google.com/identity/gsi/web/guides/fedcm-migration)). * Uses the supplied token expiration information to **more accurately compute `isSignedIn()` and `canAccessScopes(scopes)`**. * This does not handle the case where users sign in/out in another tab or from outside the web app, that's still something that needs to be checked server-side. * **Deprecates the `signIn()` method on the web.** * Users should migrate to a combination of `renderButton()` and `silentSignIn()`, as described [here](https://pub.dev/packages/google_sign_in_web#migrating-to-v011-and-v012-google-identity-services). ### Issues * FedCM: * Fixes flutter/flutter#133703 (once rebuilt/redeployed) * Fixes `b/301259123` * Token expiration: * Unblocks `b/245740319` ### Testing * Added a few unit tests * Manually verified token expiration: https://dit-gis-test.web.app

ditman requested a review from stuartmorgan October 25, 2023 02:10

github-actions bot added p: google_sign_in platform-web labels Oct 25, 2023

ditman force-pushed the gsi-web-use-fedcm branch from 668441f to 28d04f2 Compare October 25, 2023 02:13

This comment was marked as resolved.

Sign in to view

stuartmorgan approved these changes Nov 1, 2023

View reviewed changes

ditman added 4 commits November 1, 2023 16:27

[gsi_web] Enable FedCM where available.

2914d71

[gis_web] Use expiration dates to improve accuracy when checking isSi…

6e358e3

…gnedIn/canAccessScopes.

[gsi_web] Update CHANGELOG and version.

f1beade

Address PR comments.

9560921

ditman force-pushed the gsi-web-use-fedcm branch from 28d04f2 to 9560921 Compare November 2, 2023 00:03

ditman added the autosubmit Merge PR when tree becomes green via auto submit App label Nov 2, 2023

auto-submit bot merged commit 33c2b4e into flutter:main Nov 2, 2023
79 checks passed

ditman deleted the gsi-web-use-fedcm branch November 2, 2023 01:07

engine-flutter-autoroll mentioned this pull request Nov 2, 2023

Roll Packages from 6ad40b9a07d3 to 33c2b4e53ad7 (3 revisions) flutter/flutter#137763

Merged

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Nov 2, 2023

33c2b4e [google_sign_in] Enable FedCM for web. Use token expiration. (f…

eeb0fcb

…lutter/packages#5225)

reidbaker mentioned this pull request Jan 12, 2024

Dialog Debug #5881

Closed

reidbaker mentioned this pull request Jan 19, 2024

[in_app_purchase] Add play country code api #5941

Merged

12 tasks

reidbaker mentioned this pull request Feb 19, 2024

[in_app_purchase_android] Add UserChoiceBilling mode. #6162

Merged

16 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[google_sign_in] Enable FedCM for web. Use token expiration. #5225

[google_sign_in] Enable FedCM for web. Use token expiration. #5225

ditman commented Oct 25, 2023

This comment was marked as resolved.

ditman commented Oct 26, 2023 •

edited

Loading

stuartmorgan left a comment

stuartmorgan Nov 1, 2023

ditman Nov 1, 2023

ditman Nov 1, 2023

stuartmorgan Nov 1, 2023

ditman Nov 1, 2023

stuartmorgan Nov 1, 2023

ditman Nov 1, 2023

ditman commented Nov 1, 2023

ditman commented Nov 2, 2023

[google_sign_in] Enable FedCM for web. Use token expiration. #5225

[google_sign_in] Enable FedCM for web. Use token expiration. #5225

Conversation

ditman commented Oct 25, 2023

Issues

Testing

Pre-launch Checklist

This comment was marked as resolved.

ditman commented Oct 26, 2023 • edited Loading

stuartmorgan left a comment

Choose a reason for hiding this comment

stuartmorgan Nov 1, 2023

Choose a reason for hiding this comment

ditman Nov 1, 2023

Choose a reason for hiding this comment

ditman Nov 1, 2023

Choose a reason for hiding this comment

stuartmorgan Nov 1, 2023

Choose a reason for hiding this comment

ditman Nov 1, 2023

Choose a reason for hiding this comment

stuartmorgan Nov 1, 2023

Choose a reason for hiding this comment

ditman Nov 1, 2023

Choose a reason for hiding this comment

ditman commented Nov 1, 2023

ditman commented Nov 2, 2023

ditman commented Oct 26, 2023 •

edited

Loading