firebase / firebase/firebase-js-sdk

`signInWithPopup` flow rejects with `auth/popup-closed-by-user` when the auth flow has redirects

Open
#7,807 8 comments 16 reactions 0 assignees View on GitHub
api: auth needs-attention question
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Operating System

macOS 13.5.2

### Browser Version

Google Chrome 119.0.6045.159

### Firebase SDK Version

10.5.2

### Firebase SDK Product:

Auth

### Describe your project's tooling

A React frontend, using typescript, swc and webpack, served through a NodeJS server.

### Describe the problem

Our project allows, besides Google OAuth and email/password authentication, custom SAML2 integrations.

Our sign in process is triggered with the `signInWithPopup` function. Some customers have SAML flows with a couple of redirects, which seem to trigger the `auth/popup-closed-by-user` error.

After investigating I've found that it happens in the following function:

```ts
private pollUserCancellation(): void {
const poll = (): void => {
if (this.authWindow?.window?.closed) {
// Make sure that there is sufficient time for whatever action to
// complete. The window could have closed but the sign in network
// call could still be in flight. This is specifically true for
// Firefox or if the opener is in an iframe, in which case the oauth
// helper closes the popup.
this.pollId = window.setTimeout(() => {
this.pollId = null;
this.reject(
_createError(this.auth, AuthErrorCode.POPUP_CLOSED_BY_USER)
);
}, _Timeout.AUTH_EVENT);
return;
}

this.pollId = window.setTimeout(poll, _POLL_WINDOW_CLOSE_TIMEOUT.get());
};

poll();
}
```
where `this.authWindow?.window?.closed` is `true`, probably due to the redirects.

Unfortunately, switching to the `signInWithRedirect` flow is not an option at this moment.

### Steps and code to reproduce issue

- Setup a simple app that uses the `signInWithPopup` flow
- Setup a custom SAML2 provider which has multiple redirects in it's authentication flow
- Try and sign in using that provider
- See that the `auth/popup-closed-by-user` error is shown even though the popup is still open.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.