Stopped Working on macOS Safari 13

[razor-1]

All of the sudden, with no changes on my side, Google sign in is broken on Safari 13.0.4 running on macOS 10.15.2.

I started getting reports from users in recent days and am able to reproduce it myself. The popup appears with the consent form/account chooser, you proceed, see a spinner for a second that says "one moment please" then the popup disappears, and none of the callbacks fire. There are no errors logged to the console that I can see when this happens. It works fine on Safari on iOS, macOS Chrome, etc.

Did something change recently?

[matt-mcdaniel]

I'm experiencing the same and wondering if it's due to Safari updates and new cookie policies:
https://webkit.org/blog/9521/intelligent-tracking-prevention-2-3/. However, I can't get their ITP Debug tool to work :/.

[razor-1]

For me even if I interact with accounts.google.com, e.g. by signing out, and then go back through the flow, it's still broken. In the past with ITP issues, interacting with the domain prevented the issue.
Despite this being the official client, I have to believe that high volume sites are using something else so they aren't randomly stuck with users who can't log in.

[matt-mcdaniel]

@razor-1 are you running your code on a CMS or platform? I'm using Sharepoint and wondering if that's contributing to the issue.

[razor-1]

No. This is a site I control top to bottom.

[danielx]

Anyone managed to find a workaround/fix yet?
We have multiple apps that use the client side sign in flow with this library.

I guess one workaround would be to not use this library and use the server side sign in flow (https://developers.google.com/identity/protocols/OAuth2WebServer)

[eesheesh]

Can you provide steps to reproduce the issue from scratch, i.e. on a fresh webpage?

The sample in https://developers.google.com/identity/sign-in/web/sign-in doesn't work for me in Safari, but if I create a simple webpage based on the guide, it does work in Safari:

<script src="https://apis.google.com/js/platform.js" async defer></script>
<meta name="google-signin-client_id" content="REPLACEME.apps.googleusercontent.com">
<div class="g-signin2" data-onsuccess="onSignIn"></div>
<script>
function onSignIn(googleUser) {
  var profile = googleUser.getBasicProfile();
  console.log('ID: ' + profile.getId()); // Do not send to your backend! Use an ID token instead.
  console.log('Name: ' + profile.getName());
  console.log('Image URL: ' + profile.getImageUrl());
  console.log('Email: ' + profile.getEmail()); // This is null if the 'email' scope is not present.
}
</script>

[danielx]

@eesheesh which version of Mac OS X are you running?

Our customers started noticing this issue after upgrading OS X to v10.15.2 from v10.15.1.
I'll create a small reproducible sample tomorrow when i get to the office.

[eesheesh]

I'm on macOS 10.15.2 with Safari 13.0.4. I'll wait for your sample, thanks!

[matt-mcdaniel]

I was able to fix the issue by making sure that Preferences->Privacy "Prevent cross-site tracking" was checked. Never thought to try this because it seemed so counterintuitive, quite the Safari 🐛 .

A couple of other conversations around the same issue:
https://discussions.apple.com/thread/250938524
https://www.reddit.com/r/Safari/comments/eaaanh/safari_1304_on_macos_changes_to_prevent_crosssite/

[danielx]

@matt-mcdaniel Thanks. Though it doesn't seem to make it work in Private Window browsing even with "Prevent cross-site tracking" enabled.

@eesheesh as matt said the bug also seems to be dependent on having "Prevent cross-site tracking" disabled in Safari privacy preferences. Though it seems that if you try to sign in to a website using this javascript client library in a Private Window it doesn't work regardless of that setting.

Our main issue with this bug is that we use Safe Exam Browser for locking down student devices in exam environments and Safe Exam Browser uses Safari to display websites. Sadly the "Prevent cross-site tracking" Safari preference doesn't fix the issue in Safe Exam Browser.

[razor-1]

I can confirm that enabling "Prevent cross-site tracking" fixes this. Is anyone who owns this repo looking at fixing it, or should we just abandon this client?

[eesheesh]

I tried this on my sample above, and it works regardless of whether "Prevent cross-site tracking" is enabled or not (I deleted cookies for my webserver's domain between tests).

If someone can add an example page that can reproduce the issue, I'll try this on my system as well.

[matt-mcdaniel]

@danielx yes a private window fails for me regardless.

@eesheesh you are on 13.0.4 right? Can you try unchecking "prevent cross-site tracking", clearing data, quitting safari and reopening and trying again? Multiple people on my team have been able to reproduce the issue.

@razor-1 this seems to be an issue with Safari rather than this repo, I know that there are open tickets with Apple for this issue. Doesn't seem to be specific to google apis.

[danielx]

@matt-mcdaniel do you have any links to these open tickets?
I looked at the webkit issue tracker but i couldn't find a ticket that i thought was created for this issue since i'm not sure what the root cause is.

[eesheesh]

Thanks @matt-mcdaniel - I can now reproduce this after following your steps (using the same test webpage I've used before).

I looked around a bit more and it seems like there are some known issues with this feature of Safari on 13.0.4, for example: https://discussions.apple.com/thread/250942525.

Based on that, I think it's best to wait for Apple to issue a fix. I can't reproduce the issue on Safari Technology Preview Release 98 (Safari 13.1, WebKit 15609.1.13.4), so I assume this is going to be fixed in Safari soon.