iterative / iterative/PyDrive2

deprecation of OAuth out-of-band (OOB) in Google OAuth

Open
#173 3 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted priority-p1 triage
Dominant language
Python
Stars
670
Forks
75
PR merge metrics
No merged PRs in 30d

Description

Because I followed DVC's [instructions](https://dvc.org/doc/user-guide/setup-google-drive-remote#using-a-custom-google-cloud-project-recommended) for creating a custom Google Cloud project, Google included me on a mass email dated May 3, 2022 stating the following:

We are writing to inform you that OAuth out-of-band (OOB) flow will be deprecated on October 3, 2022, to
protect users from phishing and app impersonation attacks.

They helpfully linked me to a [blog post](https://notifications.google.com/g/p/AD-FnEwFnqo4PkjE8myWoowpPEQr42E5gVnAPAEtIoaWxktbo11fxYnUdd_ZjOPL_YJJ567MKNsoWT-A8zO1om9uJvNwxaEsyhPCqdxM8RVioM1rvGDXaQDC6ubxxqLMCgmfPHCcEiv8GYhu6-V7wQ) with guidance on making a change.

Having read the blog post and traced DVC's [GoogleAuth call](https://github.com/iterative/dvc/blob/d92c6fed67828a992609c0f49548dba8b7fda15d/dvc/fs/gdrive.py#L238) to the "offending" use of the out-of-band flow [by PyDrive2](https://github.com/iterative/PyDrive2/blob/2e43e4561d965ce78dc158a02fbdb75ba6c38105/pydrive2/auth.py#L288), I think I can make a recomendation. It seems like PyDrive2 should deprecate `CommandLineAuthentication` and help users migrate to a flow using a Loopback IP address. This may be as simple as forcing users (like DVC, so should be easy for you) to switch to `LocalWebserverAuth`, if I understand it correctly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.