Problem with Google OAuth2 and Firebase REST API: Missing Initial State Issue

[gloriahky]

I am currently using Firebase Authentication in my app and have successfully implemented email/password login functionality. Now, I am trying to add Google OAuth2 sign-up and sign-in capabilities.

I have been following the official Firebase REST API documentation:

https://firebase.google.com/docs/reference/rest/auth?hl=en#section-sign-in-with-oauth-credential

According to the documentation, the following request should be sent:

curl 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=[API_KEY]' \ -H 'Content-Type: application/json' \ --data-binary '{"postBody":"id_token=[GOOGLE_ID_TOKEN]&providerId=[google.com]","requestUri":"[http://localhost]","returnIdpCredential":true,"returnSecureToken":true}'

My question is, where and how can I obtain the id_token value in the postBody of this request example?

As mentioned, I am trying to implement both sign-up and sign-in using Google OAuth2.

I have attempted to obtain the Access Token using the following request and use it as the id_token value (replacing [GOOGLE_ID_TOKEN]) in the postBody:

https://accounts.google.com/o/oauth2/v2/auth?client_id=[My_Project_OAuth_Client_ID]&redirect_uri=https://my_firebase_project_name.firebaseapp.com/__/auth/handler&response_type=code&scope=https://www.googleapis.com/auth/userinfo.email&state=[Secret_Key]

I have configured the necessary credentials in the Google Cloud Console.

However, when I make this request, the following message is displayed in the web browser:

Unable to process request due to missing initial state. This may happen if browser sessionStorage is inaccessible or accidentally cleared. Some specific scenarios are - 1) Using IDP-Initiated SAML SSO. 2) Using signInWithRedirect in a storage-partitioned browser environment.

This issue occurs in both Android and Windows Chrome.

Below are my blocks. The blocks inside AfterActivity are not executed. In case you are wondering, the reason I used WebViewer was to test if I could extract the required values ​​by setting the homeurl of the WebView to redirect_uri. Also, the blocks inside WebViewStringChange are not executed.

I am wondering if I am following the correct approach and if I am missing any steps.

Could you please provide guidance on this matter?

Thank you for your assistance.

[Peter]

Could you stop posting multiple topics with the same question. This is your third time. This is not allowed.

[gloriahky]

I'm sorry. After I wrote the post, I found out that it contained sensitive information. I could edit the post, but I knew that the history would remain, so I just deleted the original post and wrote it again.

[TIMAI2]

The native webviewer may not be up to the task.

You might try using one of these extensions:

webviewextra

customwebview

Both of which will provide for session storage (or local storage )

[gloriahky]

Thank you. TIMAI2
After seeing your answer, I changed the activitystarter of my original block to customwebview. The Google login page appears, and when I log in, I successfully log in to Google via firebase authentication.
However, the Google login page asks for login ID and password every time. I want to display a list of accounts that have already logged in and let me select one from the list.

I also tried enabling JS of customewebview and setting cachemode to -1, but the result is always the same. Is it because of customwebview?

I think my problem is the same as the problem you answered in the article below.

Google auth disallowed_useragent 403

I have one more question... If I open the application in web browser, it asked to choose the Google account. This is perfectly fine. [WhatsApp Image 2022-06-01 at 4.48.36 PM (1)] But, whenever I try to log in with Google from the app, it does not list the Google account from my android device, instead, it asks to enter my email ID and password. [WhatsApp Image 2022-06-01 at 4.49.47 PM] In case of an app, how can I list Google accounts instead of manually entering email and password?

Can you guide me in more detail on your answer in the article above?

[TIMAI2]

Ensure you have local/session storage enabled in CustomWebView.

You may need to remove more than just ; wv in your user-agent, I also had to remove Version/4.0 and Mobile for things to work in WebViewExtra. You might also consider a complete user-agent replacement: Device Atlas

You would know if you were getting the user-agent disallowed message...

[gloriahky]

@TIMAI2

You may need to remove more than just ; wv in your user-agent, I also had to remove Version/4.0 and Mobile for things to work in WebViewExtra.

Thanks for the reply, but I don't understand this. I'm using customwebview, does it have to do with the webviewextra extension? Do I just remove the 'Version/4.0' and 'Mobile' strings, like I did with the '; wv'? I wanted to try it myself and ask, but I'm out right now.

[TIMAI2]

@gloriahky

Do I just remove the 'Version/4.0' and 'Mobile' strings, like I did with the '; wv'?

Yes, try it...

note: the customwebview (and the webviewer) need to be signed in to a google account (or accounts) in order to retain the "signed in" status when revisiting. Also ensure that cookies are working correctly for this to happen.