Google OAuth sign in page lists 'email address' as part of the authorization request even though the scope supplied doesn't have email access
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 2k
- Forks
- 867
- Avg merge
- 4d 48m
- Merged PRs (30d)
- 1
Description
I'm using UnityGoogleDrive which relies on AppAuth for both iOS and Android. I'm not entirely sure if this is more of a question for AppAuth maintainers, or possibly Google. But when using the following scopes https://www.googleapis.com/auth/drive.file and openid, I see this page when signing in:
Android exhibits the same behavior on that first screen. On the second screen, the scope permissions are listed correctly.
I've tested this on an iPad Pro running iPadOS 15.5 and on an Android Pixel XL running Android 10.
Does this seem more like a Google issue? I just don't want to confuse users, as we're explicitly not requesting email. Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the authorization flow described for UnityGoogleDrive with the drive.file and openid scopes on iOS and Android. Compare the first and second Google permission screens, then inspect the AppAuth-iOS entry points involved in constructing the authorization request. Done means determining whether AppAuth-iOS adds an email scope or whether the wording comes from Google.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, ios
- Domain
- authentication, mobile-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100