Issue 482: AuthorizeAsync - browser will not self-close

OAuth redirects to a page served by a local HTTP server. The server collects the authentication data and serves a page that attempts to close the browser window, but it fails with a JavaScript error.

[peleyal, 2014-11-01 23:41:01]

Beside my other comment, please change the hear to:

"Issue 482: AuthorizeAsync - browser will not self-close"

https://codereview.appspot.com/162630043/diff/1/Src/GoogleApis.Auth.DotNet4/O...
File Src/GoogleApis.Auth.DotNet4/OAuth2/LocalServerCodeReceiver.cs (left):

https://codereview.appspot.com/162630043/diff/1/Src/GoogleApis.Auth.DotNet4/O...
Src/GoogleApis.Auth.DotNet4/OAuth2/LocalServerCodeReceiver.cs:48: Received
verification code. Closing...
This code works before (or still working for Windows 7)
How can we make it work in Windows 8 \ Windows 8.1 as well?

The obvious solution is to delete this code, but I want us to actually close the
browser (IE, chrome, etc.)

That's the purpose of this bug.

[jmcgrew, 2014-11-03 19:49:42]

On 2014/11/01 23:41:01, peleyal wrote:
> This code works before (or still working for Windows 7)
> How can we make it work in Windows 8 \ Windows 8.1 as well?
> 
> The obvious solution is to delete this code, but I want us to actually close
the
> browser (IE, chrome, etc.)
> 
> That's the purpose of this bug.

I don't think this is related to Windows 8. The bug was reported by a Windows 7
user.

I think the cause suggested in the bug report is correct: newer browsers don't
allow scripts to close windows that weren't opened by scripts, even their own
windows. The current JS code exploits a bug in Chrome that allowed a page to do
it after reopening itself in the same window, but that bug has been fixed. Even
scripts initiated by user actions can't close the window; I tried adding a
"click here to close" button, but clicking on it just reproduces the same JS
error.

Since we're doing the authentication in an external browser window, I don't
think there's a clean and portable way to close the window when the
authentication flow is over.

The best alternative that comes to mind is embedding a browser window in the
application, but that has some downsides: the user will have to reenter their
credentials instead of using the session from their main browser, and we'll need
separate implementations for WinForms, WPF, Gtk#, etc. What do you think?

[peleyal, 2014-11-04 21:01:59]

We talked on that offline. I'll support however you decide to continue from
here.
Thanks,
Eyal

On Mon, Nov 3, 2014 at 2:49 PM, <jmcgrew@google.com> wrote:

> On 2014/11/01 23:41:01, peleyal wrote:
>
>> This code works before (or still working for Windows 7)
>> How can we make it work in Windows 8 \ Windows 8.1 as well?
>>
>
>  The obvious solution is to delete this code, but I want us to actually
>>
> close the
>
>> browser (IE, chrome, etc.)
>>
>
>  That's the purpose of this bug.
>>
>
> I don't think this is related to Windows 8. The bug was reported by a
> Windows 7 user.
>
> I think the cause suggested in the bug report is correct: newer browsers
> don't allow scripts to close windows that weren't opened by scripts,
> even their own windows. The current JS code exploits a bug in Chrome
> that allowed a page to do it after reopening itself in the same window,
> but that bug has been fixed. Even scripts initiated by user actions
> can't close the window; I tried adding a "click here to close" button,
> but clicking on it just reproduces the same JS error.
>
> Since we're doing the authentication in an external browser window, I
> don't think there's a clean and portable way to close the window when
> the authentication flow is over.
>
> The best alternative that comes to mind is embedding a browser window in
> the application, but that has some downsides: the user will have to
> reenter their credentials instead of using the session from their main
> browser, and we'll need separate implementations for WinForms, WPF,
> Gtk#, etc. What do you think?
>
> https://codereview.appspot.com/162630043/
>

[jmcgrew, 2014-11-15 01:10:24]

Restored the JavaScript and just changed the message to indicate that the window
may need to be closed.

[peleyal, 2014-11-19 22:07:26]

LGTM sir :)

[LindaL, 2014-12-01 14:58:17]

On 2014/11/19 22:07:26, peleyal wrote:
> LGTM sir :)

The bug is also in windows 7.  Having a browser window in the project and then
loading it there does work, but its not as clean. It would be nice if we could
get this working again.

[jmcgrew, 2014-12-02 07:31:04]

See the discussion at
https://code.google.com/p/google-api-dotnet-client/issues/detail?id=482 -
this appears to be a limitation of modern browsers. IMO an embedded browser
would be the cleanest alternative, but also the least portable.


Jesse McGrew | Apps Capacity SRE | jmcgrew@google.com | 650-253-6516

On Mon, Dec 1, 2014 at 6:58 AM, <laurly71@gmail.com> wrote:

> On 2014/11/19 22:07:26, peleyal wrote:
>
>> LGTM sir :)
>>
>
> The bug is also in windows 7.  Having a browser window in the project
> and then loading it there does work, but its not as clean. It would be
> nice if we could get this working again.
>
> https://codereview.appspot.com/162630043/
>