Google blocks SSO sign-up and login through embedded browsers

[lihua.zhang]

Problem statement

We can’t sign up and log in through an embedded browser and receive the 403 error disallowed_useragent.

Solution

There are risks when implementing a login from an embedded WebView. Full documentation here:

RFC 6819: OAuth 2.0 Threat Model and Security Considerations

The following Community topics or blog articles are good references for solving this error.

403: disallowed_useragent for web login from embedded browsers

There was a past thread about this, but it was closed without being answered: Google - Disallowed user agent when using Auth0 Lock I also cross-posted this question to Stack Overflow, and from there linked a couple other relevant Stack Overflow questions. Google disallowed logging into Google from webviews a few years ago, and Auth0 also made a blog post about workarounds, but it all seems to focus on native apps, not web apps that offer Google as a login option. But my company’s app is a web…

Modernizing OAuth interactions in Native Apps for Better Usability and Security

Google Blocks OAuth Requests Made Via Embedded Browsers