OAuth doesn't work for Google accounts in MakeCode on some version of Android

[jaustin]

Describe the bug

microsoft/pxt-microbit#5590

@microbit-matt-hillsdon can reproduce this.

[martinwork]

Seems to be Google policy to disallow in webviews. I don't understand why it works in the iOS app.
https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html

[jaustin]

I can also reproduce this for me on my Android 8.1 device even though it lets me get through the whole entering password flow etc. 403: disallowed_useragent

[martinwork]

Reported in support ticket https://support.microbit.org/helpdesk/tickets/74336 (private)

[martinwork]

Reported in support ticket https://support.microbit.org/helpdesk/tickets/74736 (private)

[microbit-carlos]

Reported from an iOS device via support on the 3rd of May, and in an in-person workshop on the 16th of July.

[abchatra]

What is the plan here? Are you using native webview in android?
May be this link helps? https://developers.google.com/identity/android-credential-manager

[martinwork]

Reported in support ticket https://support.microbit.org/helpdesk/tickets/83590

[abchatra]

@eanders-ms can you pitch in here?

[eanders-ms]

On the device where it's failing for MakeCode, does Google auth work for other 3rd party (non-Google) apps?

[martinwork]

Seems to be Google policy to disallow in webviews.
https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html

This might help - I haven't read it yet!
https://developer.android.com/identity/sign-in/credential-manager-webview

[eanders-ms]

We may need to leverage the native Android app to manage the authentication process, which would pass the final redirect URL back to the WebView. From there we can get the auth token and cookie. Custom Tabs might be a suitable API for handling the oauth flow from the native side.

[martinwork]

Reported in support ticket https://support.microbit.org/helpdesk/tickets/83933 (private)