[Desktop] Can't sign in with firebase website with shields up #5075

ericelliott · 2019-06-29T21:38:50Z

Description

We use Firebase for sign in with GitHub on EricElliottJS.com. I'm unable to sign in with shields up in Brave. It works great with shields down.

Steps to Reproduce

Go to EricElliottJS.com and click "sign in" in the upper right hand corner.
Make sure you have shields up.
Click "Sign In with GitHub"

Actual result:

Sign in fails and an error object is logged to the console:

{
  code: "auth/web-storage-unsupported",
  message: "This browser is not supported or 3rd party cookies and data may be disabled."
}

Expected result:

Delegated authentication is a common way to improve security and user privacy by reducing the available attack surface for nefarious collectors of usernames and passwords. I hope we can figure out how to enable commonly used authentication methods and still protect user privacy.

Reproduces how often:

Easily reproduced.

Brave version (brave://version info)

0.65.120 Chromium: 75.0.3770.90 (Official Build) (64-bit)

Revision | a6dcaf7e3ec6f70a194cc25e8149475c6590e025-refs/branch-heads/3770@{#1003}
OS | Mac OS X

Version/Channel Information:

Don't know. Don't have time to check.

Can you reproduce this issue with the current release?
Can you reproduce this issue with the beta channel?
Can you reproduce this issue with the dev channel?
Can you reproduce this issue with the nightly channel?

Other Additional Information:

Does the issue resolve itself when disabling Brave Shields?
Yes.
Does the issue resolve itself when disabling Brave Rewards?
Don't know.
Is the issue reproducible on the latest version of Chrome?
No.

Miscellaneous Information:

P.S. Using Brave as my default browser. Looking good. I have high hopes for the future of Brave and the BAT ecosystem.

ryanbr · 2019-07-02T11:59:54Z

Seems to have fixed itself

rebron · 2019-07-05T17:04:11Z

Closed, fixed by above commit.

ryanbr · 2019-07-07T03:36:39Z

Just a followup @ericelliott enabling all cookies helps.

btlechowski · 2019-07-18T16:31:16Z

The issue is still reproducible with default shields settings.

Note: Allowing all cookies fixes the issue.

Tested on

Brave	0.67.110 Chromium: 75.0.3770.100 (Official Build) beta(64-bit)
Revision	cd0b15c8b6a4e70c44e27f35c37a4029bad3e3b0-refs/branch-heads/3770@{#1033}
OS	Ubuntu 18.04 LTS

kjozwiak · 2019-07-25T16:53:55Z

Reproduced on macOS 10.14.5 x64 using the following build:

Brave	0.67.117 Chromium: 76.0.3809.62 (Official Build) (64-bit)
Revision	7b77856b3aa34d72f246d12340fc1ded8b2c0e83-refs/branch-heads/3809@{#798}
OS	Mac OS X

rebron · 2019-07-25T17:14:27Z

@ryanbr Can you give this another look? Looks like an issue with something more than firebaseapp

jcubic · 2019-10-08T07:10:42Z

Not sure if this is the same but I've got error "The popup has been closed by the user before finalizing the operation." on https://terminal.jcubic.pl#chat when I try to login with GitHub using Firebase, I don't see anything in console.

ryanbr · 2019-10-08T07:27:57Z

Can you test in Brave-beta @jcubic ?

ryanbr · 2019-10-08T07:42:49Z

Not sure what causes it, but I could login via /login github in Brave-beta

jcubic · 2019-10-08T08:59:43Z

Tested on Brave beta, got the same error. But this time the popup was closed, in original brave (on Fedora) the popup remained open but without any visible stuff.

ryanbr · 2019-10-08T10:29:04Z

Okay, Just allow all cookies in sheilds on https://terminal.jcubic.pl/#chat

Related to blocking of cookies on coveralls.io.

jcubic · 2019-10-08T10:59:02Z

coveralls.io is just code coverage report, it's not related. The issue it with GitHub and Firebase. Only those, maybe some other domains from Firebase. Allowing 3rd party cookies is working, but it's not related to coveralls.io. Google use lot of domains in their infrastructure.

Is it possible to enable 3rd party cookies for single domain? I've only seen one dropdown where you can enable or disable all or only 3rd party.

jcubic · 2019-10-08T12:03:39Z

For reference, maybe something will be able to rewrite Firebase login with this: SO: Use Google Firebase Authentication without 3rd Party Cookies I will try when I have time.

indreklasn · 2019-10-22T14:13:29Z

Any updates on the issue? I started getting this issue today when trying to login with Google auth with firebase. Works on Chrome.

jcubic · 2019-10-22T14:49:32Z

@indreklasn I think you need to enable 3rd party cookies for that page. The only solution I can think of is to have one global allow 3rd party cookie place where you can enable cookies from Google and/or Firebase. This may request to investigate what base domain firebase use that need 3rd party cookies, visit that domain and then enable 3rd party cookies so it will enable to use on all firebase websites. Maybe some extension (if brave allow extensions) that will enable Firebase login on any new website, without any other 3rd party cookie.

indreklasn · 2019-10-23T08:43:37Z

@jcubic I have already enabled cookies and disabled shields. :/

This answer fixed the issue for me: https://stackoverflow.com/a/51277982/5073961

ericelliott · 2019-10-24T21:15:57Z

~~I'm seeing this now even with shields down. Signing in with Chrome works great.~~

Just installed and tried it with Brave Version 0.70.121 Chromium: 78.0.3904.70 (Official Build) (64-bit)

Works with shields down.
Does not work with shields up.

AoDev · 2020-01-06T11:51:49Z

Facing the same issue here. I just want to link this issue from firebase-js-sdk repo.

aormsby · 2020-01-08T15:02:09Z

No idea if this helps, but here's a specific error message I recently got showing that seemingly all requests from 'googleapis.com' are blocked when shields are up. The site in question does use Firebase for authentication.

{"error":
    {"code":403,"message":"Requests from referer https://www.googleapis.com/ are blocked.","errors": 
       [{"message":"Requests from referer https://www.googleapis.com/ are 
            blocked.","domain":"global","reason":"forbidden"}],
    "status":"PERMISSION_DENIED"}}

I've recently been unable to sign in using google sign-in everywhere I've tried, and the browser even kicks me out of things I'm already signed into sometimes. :sad:

bsclifton · 2020-01-08T16:43:42Z

@aormsby do you have Allow Google logins enabled? It's enabled by default, but you can check in brave://settings/socialBlocking

aormsby · 2020-01-09T11:31:59Z

Nope. I don't even see the option. Hopefully I'm not missing some important detail here.

bsclifton · 2020-01-09T23:31:44Z

ah ok - that feature is only on 1.3 and newer (which is on our Beta channel)

alexlouden · 2020-01-15T07:39:07Z

No idea if this helps, but here's a specific error message I recently got showing that seemingly all requests from 'googleapis.com' are blocked when shields are up. The site in question does use Firebase for authentication.

I just ran into this today, discovered that Brave changes the referer header on the request to googleapis.com (instead of myapp.com), so the referer restriction on the API key fails. See https://console.developers.google.com/apis/credentials under "Website restrictions". I'm just going to catch this error and show a message to the user explaining what's happening, unless anyone has any other ideas?

gkgrepo · 2020-02-13T19:21:16Z

I was getting a 403 error message as well as follows
..

I had to disable "blocking cross-site cookies" to allow all cookies to get this to work..

dginovker · 2020-05-27T14:28:53Z

No longer works, here's a project you can test on as well to get the web-page's source code: https://github.com/armand1m/react-firebase-authentication-medium

fmarier · 2020-06-15T19:02:09Z

We've just made a change to how we modify the referrer on cross-origin POST requests (brave/brave-core#5613). This might address the underlying issue here.

Would anybody be able to test again using Brave Nightly?

jperasmus · 2020-06-25T10:19:33Z

Only works for me if I change the default "Only block cross-site cookies" to "Allow cookies" in the brave://settings/shields settings. Obviously not ideal.

fmarier · 2020-06-25T18:44:18Z

Thanks for the testing. It looks like aside from the referrer problems (now fixed), there is also a problem due to third-party cookies: #10367

pes10k · 2020-06-26T01:29:30Z

closed with brave/brave-core#5952

GeetaSarvadnya · 2020-07-28T17:23:45Z

Verification passed on


Brave | 1.12.104 Chromium: 84.0.4147.89 (Official Build) dev (64-bit)
-- | --
Revision | 19abfe7bcba9318a0b2a6bc6634a67fc834aa592-refs/branch-heads/4147@{#852}
OS | Windows 10 OS Version 1903 (Build 18362.959)

Reproduced issue in 1.11.x

Qi {code: "auth/web-storage-unsupported", message: "This browser is not supported or 3rd party cookies and data may be disabled."}

Verified STR from the description able to "Sign In with GitHub" with default shield settings and there is no 3rd party cookies and data may be disabled message displayed in the console

ryanbr added a commit to ryanbr/referrer-whitelist that referenced this issue Jun 29, 2019

Firebase fix, brave/brave-browser#5075

78a33f5

rebron added this to the 0.67.x - Beta milestone Jul 5, 2019

rebron closed this as completed Jul 5, 2019

rebron added QA/Yes webcompat/not-shields-related Sites are breaking because of something other than Shields. labels Jul 8, 2019

btlechowski reopened this Jul 18, 2019

rebron removed this from the 0.67.x - Release milestone Jul 25, 2019

mengesb mentioned this issue Apr 26, 2020

Referer header stripped breaks OKTA SAML integration #9470

Closed

fmarier mentioned this issue Jun 5, 2020

Change sub-resource referrer policy to report 3p origin #8696

Closed

ryanbr mentioned this issue Jun 24, 2020

Fixes Firebase issues brave/brave-browser#10367 brave/brave-browser#9852 brave/brave-core#5938

Closed

6 tasks

pes10k mentioned this issue Jun 25, 2020

allow 3p storage in firebase when google auth is enabled brave/brave-core#5952

Merged

pes10k added the OS/Windows label Jun 26, 2020

pes10k added this to the 1.12.x - Nightly milestone Jun 26, 2020

pes10k closed this as completed Jun 26, 2020

pes10k added release-notes/exclude release-notes/include and removed release-notes/exclude labels Jun 26, 2020

rebron changed the title ~~Can't sign in with firebase website with shields up~~ [Desktop] Can't sign in with firebase website with shields up Jul 20, 2020

GeetaSarvadnya added the QA Pass-Win64 label Jul 28, 2020

LaurenWags mentioned this issue Aug 11, 2020

[Desktop] Release Notes for 1.12.x (Release Channel) #11180

Closed

rebron added the release-notes/exclude label Aug 12, 2020

LaurenWags removed the release-notes/include label Aug 12, 2020

jumde mentioned this issue Oct 19, 2020

[Android] Remove cookie exceptions for android #10455

Closed

ryanbr mentioned this issue Feb 9, 2022

Test patch for revert of https://github.com/brave/brave-core/pull/5952 brave/brave-core#12115

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Desktop] Can't sign in with firebase website with shields up #5075

[Desktop] Can't sign in with firebase website with shields up #5075

ericelliott commented Jun 29, 2019 •

edited

Loading

ryanbr commented Jul 2, 2019

rebron commented Jul 5, 2019

ryanbr commented Jul 7, 2019

btlechowski commented Jul 18, 2019

kjozwiak commented Jul 25, 2019

rebron commented Jul 25, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019

ryanbr commented Oct 8, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019 •

edited

Loading

jcubic commented Oct 8, 2019 •

edited

Loading

jcubic commented Oct 8, 2019 •

edited

Loading

indreklasn commented Oct 22, 2019

jcubic commented Oct 22, 2019

indreklasn commented Oct 23, 2019 •

edited

Loading

ericelliott commented Oct 24, 2019 •

edited

Loading

AoDev commented Jan 6, 2020

aormsby commented Jan 8, 2020

bsclifton commented Jan 8, 2020

aormsby commented Jan 9, 2020 •

edited

Loading

bsclifton commented Jan 9, 2020

alexlouden commented Jan 15, 2020 •

edited

Loading

gkgrepo commented Feb 13, 2020

dginovker commented May 27, 2020

fmarier commented Jun 15, 2020

jperasmus commented Jun 25, 2020

fmarier commented Jun 25, 2020 •

edited

Loading

pes10k commented Jun 26, 2020

GeetaSarvadnya commented Jul 28, 2020 •

edited

Loading

[Desktop] Can't sign in with firebase website with shields up #5075

[Desktop] Can't sign in with firebase website with shields up #5075

Comments

ericelliott commented Jun 29, 2019 • edited Loading

Description

Steps to Reproduce

Actual result:

Expected result:

Reproduces how often:

Brave version (brave://version info)

0.65.120 Chromium: 75.0.3770.90 (Official Build) (64-bit)

Version/Channel Information:

Other Additional Information:

Miscellaneous Information:

ryanbr commented Jul 2, 2019

rebron commented Jul 5, 2019

ryanbr commented Jul 7, 2019

btlechowski commented Jul 18, 2019

kjozwiak commented Jul 25, 2019

rebron commented Jul 25, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019

ryanbr commented Oct 8, 2019

jcubic commented Oct 8, 2019

ryanbr commented Oct 8, 2019 • edited Loading

jcubic commented Oct 8, 2019 • edited Loading

jcubic commented Oct 8, 2019 • edited Loading

indreklasn commented Oct 22, 2019

jcubic commented Oct 22, 2019

indreklasn commented Oct 23, 2019 • edited Loading

ericelliott commented Oct 24, 2019 • edited Loading

AoDev commented Jan 6, 2020

aormsby commented Jan 8, 2020

bsclifton commented Jan 8, 2020

aormsby commented Jan 9, 2020 • edited Loading

bsclifton commented Jan 9, 2020

alexlouden commented Jan 15, 2020 • edited Loading

gkgrepo commented Feb 13, 2020

dginovker commented May 27, 2020

fmarier commented Jun 15, 2020

jperasmus commented Jun 25, 2020

fmarier commented Jun 25, 2020 • edited Loading

pes10k commented Jun 26, 2020

GeetaSarvadnya commented Jul 28, 2020 • edited Loading

ericelliott commented Jun 29, 2019 •

edited

Loading

ryanbr commented Oct 8, 2019 •

edited

Loading

jcubic commented Oct 8, 2019 •

edited

Loading

jcubic commented Oct 8, 2019 •

edited

Loading

indreklasn commented Oct 23, 2019 •

edited

Loading

ericelliott commented Oct 24, 2019 •

edited

Loading

aormsby commented Jan 9, 2020 •

edited

Loading

alexlouden commented Jan 15, 2020 •

edited

Loading

fmarier commented Jun 25, 2020 •

edited

Loading

GeetaSarvadnya commented Jul 28, 2020 •

edited

Loading