Can't sign in with firebase website with shields up #5075

ericelliott · 2019-06-29T21:38:50Z

Description

We use Firebase for sign in with GitHub on EricElliottJS.com. I'm unable to sign in with shields up in Brave. It works great with shields down.

Steps to Reproduce

Go to EricElliottJS.com and click "sign in" in the upper right hand corner.
Make sure you have shields up.
Click "Sign In with GitHub"

Actual result:

Sign in fails and an error object is logged to the console:

{
  code: "auth/web-storage-unsupported",
  message: "This browser is not supported or 3rd party cookies and data may be disabled."
}

Expected result:

Delegated authentication is a common way to improve security and user privacy by reducing the available attack surface for nefarious collectors of usernames and passwords. I hope we can figure out how to enable commonly used authentication methods and still protect user privacy.

Reproduces how often:

Easily reproduced.

Brave version (brave://version info)

0.65.120 Chromium: 75.0.3770.90 (Official Build) (64-bit)

Revision | a6dcaf7e3ec6f70a194cc25e8149475c6590e025-refs/branch-heads/3770@{#1003}
OS | Mac OS X

Version/Channel Information:

Don't know. Don't have time to check.

Can you reproduce this issue with the current release?
Can you reproduce this issue with the beta channel?
Can you reproduce this issue with the dev channel?
Can you reproduce this issue with the nightly channel?

Other Additional Information:

Does the issue resolve itself when disabling Brave Shields?
Yes.
Does the issue resolve itself when disabling Brave Rewards?
Don't know.
Is the issue reproducible on the latest version of Chrome?
No.

Miscellaneous Information:

P.S. Using Brave as my default browser. Looking good. I have high hopes for the future of Brave and the BAT ecosystem.


        Firebase fix, brave/brave-browser#5075

ryanbr · 2019-07-02T11:59:54Z

Seems to have fixed itself

rebron · 2019-07-05T17:04:11Z

Closed, fixed by above commit.

ryanbr · 2019-07-07T03:36:39Z

Just a followup @ericelliott enabling all cookies helps.

btlechowski · 2019-07-18T16:31:16Z

The issue is still reproducible with default shields settings.

Note: Allowing all cookies fixes the issue.

Tested on

Brave	0.67.110 Chromium: 75.0.3770.100 (Official Build) beta(64-bit)
Revision	cd0b15c8b6a4e70c44e27f35c37a4029bad3e3b0-refs/branch-heads/3770@{#1033}
OS	Ubuntu 18.04 LTS

kjozwiak · 2019-07-25T16:53:55Z

Reproduced on macOS 10.14.5 x64 using the following build:

Brave	0.67.117 Chromium: 76.0.3809.62 (Official Build) (64-bit)
Revision	7b77856b3aa34d72f246d12340fc1ded8b2c0e83-refs/branch-heads/3809@{#798}
OS	Mac OS X

rebron · 2019-07-25T17:14:27Z

@ryanbr Can you give this another look? Looks like an issue with something more than firebaseapp

jcubic · 2019-10-08T07:10:42Z

Not sure if this is the same but I've got error "The popup has been closed by the user before finalizing the operation." on https://terminal.jcubic.pl#chat when I try to login with GitHub using Firebase, I don't see anything in console.

ryanbr · 2019-10-08T07:27:57Z

Can you test in Brave-beta @jcubic ?

ryanbr · 2019-10-08T07:42:49Z

Not sure what causes it, but I could login via /login github in Brave-beta

jcubic · 2019-10-08T08:59:43Z

Tested on Brave beta, got the same error. But this time the popup was closed, in original brave (on Fedora) the popup remained open but without any visible stuff.

ryanbr · 2019-10-08T10:29:04Z

Okay, Just allow all cookies in sheilds on https://terminal.jcubic.pl/#chat

Related to blocking of cookies on coveralls.io.

jcubic · 2019-10-08T10:59:02Z

coveralls.io is just code coverage report, it's not related. The issue it with GitHub and Firebase. Only those, maybe some other domains from Firebase. Allowing 3rd party cookies is working, but it's not related to coveralls.io. Google use lot of domains in their infrastructure.

Is it possible to enable 3rd party cookies for single domain? I've only seen one dropdown where you can enable or disable all or only 3rd party.

jcubic · 2019-10-08T12:03:39Z

For reference, maybe something will be able to rewrite Firebase login with this: SO: Use Google Firebase Authentication without 3rd Party Cookies I will try when I have time.

indreklasn · 2019-10-22T14:13:29Z

Any updates on the issue? I started getting this issue today when trying to login with Google auth with firebase. Works on Chrome.

jcubic · 2019-10-22T14:49:32Z

@indreklasn I think you need to enable 3rd party cookies for that page. The only solution I can think of is to have one global allow 3rd party cookie place where you can enable cookies from Google and/or Firebase. This may request to investigate what base domain firebase use that need 3rd party cookies, visit that domain and then enable 3rd party cookies so it will enable to use on all firebase websites. Maybe some extension (if brave allow extensions) that will enable Firebase login on any new website, without any other 3rd party cookie.

indreklasn · 2019-10-23T08:43:37Z

@jcubic I have already enabled cookies and disabled shields. :/

This answer fixed the issue for me: https://stackoverflow.com/a/51277982/5073961

ericelliott · 2019-10-24T21:15:57Z

~~I'm seeing this now even with shields down. Signing in with Chrome works great.~~

Just installed and tried it with Brave Version 0.70.121 Chromium: 78.0.3904.70 (Official Build) (64-bit)

Works with shields down.
Does not work with shields up.

AoDev · 2020-01-06T11:51:49Z

Facing the same issue here. I just want to link this issue from firebase-js-sdk repo.

aormsby · 2020-01-08T15:02:09Z

No idea if this helps, but here's a specific error message I recently got showing that seemingly all requests from 'googleapis.com' are blocked when shields are up. The site in question does use Firebase for authentication.

{"error":
    {"code":403,"message":"Requests from referer https://www.googleapis.com/ are blocked.","errors": 
       [{"message":"Requests from referer https://www.googleapis.com/ are 
            blocked.","domain":"global","reason":"forbidden"}],
    "status":"PERMISSION_DENIED"}}

I've recently been unable to sign in using google sign-in everywhere I've tried, and the browser even kicks me out of things I'm already signed into sometimes. :sad:

bsclifton · 2020-01-08T16:43:42Z

@aormsby do you have Allow Google logins enabled? It's enabled by default, but you can check in brave://settings/socialBlocking

aormsby · 2020-01-09T11:31:59Z

Nope. I don't even see the option. Hopefully I'm not missing some important detail here.

bsclifton · 2020-01-09T23:31:44Z

ah ok - that feature is only on 1.3 and newer (which is on our Beta channel)

alexlouden · 2020-01-15T07:39:07Z

No idea if this helps, but here's a specific error message I recently got showing that seemingly all requests from 'googleapis.com' are blocked when shields are up. The site in question does use Firebase for authentication.

I just ran into this today, discovered that Brave changes the referer header on the request to googleapis.com (instead of myapp.com), so the referer restriction on the API key fails. See https://console.developers.google.com/apis/credentials under "Website restrictions". I'm just going to catch this error and show a message to the user explaining what's happening, unless anyone has any other ideas?

gkgrepo · 2020-02-13T19:21:16Z

I was getting a 403 error message as well as follows
..

I had to disable "blocking cross-site cookies" to allow all cookies to get this to work..

ryanbr added a commit to ryanbr/referrer-whitelist that referenced this issue Jun 29, 2019

Firebase fix, brave/brave-browser#5075

78a33f5

rebron added this to the 0.67.x - Beta milestone Jul 5, 2019

rebron closed this Jul 5, 2019

rebron added QA/Yes webcompat labels Jul 8, 2019

btlechowski reopened this Jul 18, 2019

rebron removed this from the 0.67.x - Release milestone Jul 25, 2019

rebron added this to To do in Web Compatibility via automation Jul 25, 2019

mengesb mentioned this issue Apr 26, 2020

Referer header stripped breaks OKTA SAML integration #9470

Open

brave / brave-browser

Can't sign in with firebase website with shields up #5075

Can't sign in with firebase website with shields up #5075

ericelliott commented Jun 29, 2019 •

edited

ryanbr commented Jul 2, 2019

rebron commented Jul 5, 2019

ryanbr commented Jul 7, 2019

btlechowski commented Jul 18, 2019

kjozwiak commented Jul 25, 2019

rebron commented Jul 25, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019

ryanbr commented Oct 8, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019 •

edited

jcubic commented Oct 8, 2019 •

edited

jcubic commented Oct 8, 2019 •

edited

indreklasn commented Oct 22, 2019

jcubic commented Oct 22, 2019

indreklasn commented Oct 23, 2019 •

edited

ericelliott commented Oct 24, 2019 •

edited

AoDev commented Jan 6, 2020

aormsby commented Jan 8, 2020

bsclifton commented Jan 8, 2020

aormsby commented Jan 9, 2020 •

edited

bsclifton commented Jan 9, 2020

alexlouden commented Jan 15, 2020 •

edited

gkgrepo commented Feb 13, 2020

brave / brave-browser

Join GitHub today

Can't sign in with firebase website with shields up #5075

Can't sign in with firebase website with shields up #5075

Comments

ericelliott commented Jun 29, 2019 • edited

Description

Steps to Reproduce

Actual result:

Expected result:

Reproduces how often:

Brave version (brave://version info)

0.65.120 Chromium: 75.0.3770.90 (Official Build) (64-bit)

Version/Channel Information:

Other Additional Information:

Miscellaneous Information:

ryanbr commented Jul 2, 2019

rebron commented Jul 5, 2019

ryanbr commented Jul 7, 2019

btlechowski commented Jul 18, 2019

kjozwiak commented Jul 25, 2019

rebron commented Jul 25, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019

ryanbr commented Oct 8, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019 • edited

jcubic commented Oct 8, 2019 • edited

jcubic commented Oct 8, 2019 • edited

indreklasn commented Oct 22, 2019

jcubic commented Oct 22, 2019

indreklasn commented Oct 23, 2019 • edited

ericelliott commented Oct 24, 2019 • edited

AoDev commented Jan 6, 2020

aormsby commented Jan 8, 2020

bsclifton commented Jan 8, 2020

aormsby commented Jan 9, 2020 • edited

bsclifton commented Jan 9, 2020

alexlouden commented Jan 15, 2020 • edited

gkgrepo commented Feb 13, 2020

ericelliott commented Jun 29, 2019 •

edited

ryanbr commented Oct 8, 2019 •

edited

jcubic commented Oct 8, 2019 •

edited

jcubic commented Oct 8, 2019 •

edited

indreklasn commented Oct 23, 2019 •

edited

ericelliott commented Oct 24, 2019 •

edited

aormsby commented Jan 9, 2020 •

edited

alexlouden commented Jan 15, 2020 •

edited