Sign-in with Google in the app

hloth commented

2026-05-07 19:36:00 +02:00

Owner

No description provided.

hloth added this to the v1.0.0 milestone

2026-05-07 19:36:00 +02:00

hloth added the

app

label

2026-05-07 19:36:00 +02:00

hloth added this to the Open Grind project

2026-05-07 19:36:00 +02:00

hloth commented

2026-05-19 01:15:32 +02:00

Author

Owner

Google sign in implementation is harder than I thought. Grindr only allowed postmessage response type in their google oauth project so
1) google prevents all url-based responses so we can't open sign in page directly, wait for redirect and sniff response code from the url - there is no code in url and there is no redirect
2) WebView built-in security prevents cross origin postMessage so we can't make a dummy page that opens sign in and receives token callback - google will only send oauth code to web grindr org origin
3) Tauri prevents cross origin ipc to web grindr org page and grindr has set csp preventing injections to the real grindr web website, so we can't open web grindr org and handle the flow via injected js - js is not injectable
Unless anyone has ideas on how to bypass all these security systems and make google sign in work, the only approach is to manually sign in on web grindr org in external browser, manually extract the token (via a script, a browser extension or any other means) and copy paste it to the app. I don't think it's possible to bypass cross origin security and get token from google sign in without extensions (which have to be signed and verified and preferrably published to stores and that's over complicated for a simple oauth login)

https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$EqyDl0B4ZghgcgSclXmbOw_EvqSA8AQnDl0orNcfcb4?via=hloth.dev&via=matrix.org&via=opengrind.org

> Google sign in implementation is harder than I thought. Grindr only allowed postmessage response type in their google oauth project so > 1\) google prevents all url-based responses so we can't open sign in page directly, wait for redirect and sniff response code from the url - there is no code in url and there is no redirect > 2\) WebView built-in security prevents cross origin postMessage so we can't make a dummy page that opens sign in and receives token callback - google will only send oauth code to web grindr org origin > 3\) Tauri prevents cross origin ipc to web grindr org page and grindr has set csp preventing injections to the real grindr web website, so we can't open web grindr org and handle the flow via injected js - js is not injectable > Unless anyone has ideas on how to bypass all these security systems and make google sign in work, the only approach is to manually sign in on web grindr org in external browser, manually extract the token (via a script, a browser extension or any other means) and copy paste it to the app. I don't think it's possible to bypass cross origin security and get token from google sign in without extensions (which have to be signed and verified and preferrably published to stores and that's over complicated for a simple oauth login) https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$EqyDl0B4ZghgcgSclXmbOw_EvqSA8AQnDl0orNcfcb4?via=hloth.dev&via=matrix.org&via=opengrind.org

hloth modified the milestone from v1.0.0 to v0.1.0-alpha.4

2026-05-28 00:05:33 +02:00

hloth modified the milestone from v0.1.0-alpha.4 to v0.1.0-beta.1

2026-05-28 17:45:34 +02:00

hloth referenced this issue

2026-06-05 20:00:49 +02:00

bug messages #94

hloth commented

2026-06-18 20:04:24 +02:00

Author

Owner

I got google sign in working on desktop via webkit webview, but chromium webkit appends X-Requested-With which signals to Google OAuth webpage to reject sign in attempt in UI.

I got google sign in working on desktop via webkit webview, but chromium webkit appends X-Requested-With which signals to Google OAuth webpage to reject sign in attempt in UI. <img src="/attachments/bb156a42-4945-40df-863e-e3a616d25cb5" width="100" />

image.png

286 KiB

hloth commented

2026-06-18 20:07:01 +02:00

Author

Owner

Web-flow comments by me in Matrix:

No idea how to work around this. User agent for oauth webview has no mention of webview, all Sec- headers point to a real chromium instance, metadata removed, https://accounts.google.com/v3/signin/_/AccountsSignInUi/data/batchexecute returns sign in rejected anyway
My choices are:

Keep pushing and trying to trick Google sign in security system

Browser extension route but it will only work in Firefox mobile and only on Android

Go raw and mint auth token for grindr android's apk and ship micro google services

Oh and I can't remove X-Requested-With in chromium webview

Android uses chromium which appends X-Requested-With and Sec- headers
latter is managable to strip, former isn't

And my announcement about milestone:

Google sign in will be deferred until beta.2 unfortunately, there is just too much problems with it in its current shape and it only works on desktop

Web-flow comments by me in Matrix: > No idea how to work around this. User agent for oauth webview has no mention of webview, all Sec- headers point to a real chromium instance, metadata removed, https://accounts.google.com/v3/signin/_/AccountsSignInUi/data/batchexecute returns sign in rejected anyway > My choices are: > 1. Keep pushing and trying to trick Google sign in security system > 2. Browser extension route but it will only work in Firefox mobile and only on Android > 3. Go raw and mint auth token for grindr android's apk and ship micro google services > Oh and I can't remove X-Requested-With in chromium webview > Android uses chromium which appends X-Requested-With and Sec- headers latter is managable to strip, former isn't And my announcement about milestone: > Google sign in will be deferred until beta.2 unfortunately, there is just too much problems with it in its current shape and it only works on desktop

hloth modified the milestone from v0.1.0-beta.1 to v0.1.0-beta.2

2026-06-18 20:07:12 +02:00

hloth commented

2026-06-30 02:16:04 +02:00

Author

Owner

Updates on Android (and potentially Windows) platforms specifically:

Grindr Web's web OAuth flow in Chromium is a dead-end. Not possible to customize Android/Chromium enough to trick Google servers to see WebView as a real web browser. See X-Requested-With header discussion.
Native Android flow which is rendered for adding accounts in the phone settings is also a dead-end. Not possible to compute the required DroidGuard device attestation token without downloading & executing a proprietary rapidly-changing VM and a per-request-generated proprietary bytecode for it in the same process as Open Grind. See microG discussion.
The only remaining route are hacky workarounds requiring configuration and setup on user's side:
- Firefox for Android browser with a browser extension
- Signing in with Google in Open Grind for Linux/macOS/iOS
- Rooted Android to access the official Grindr app's storage and retrieve Grindr API session token from there

Discussion in Matrix:
https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$1NTT0PTZ1a2NMTnyB-8qae5VOL7zGbLhhr3L88mTxCo
https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$U1rIHAFR-LIfUuDyh3tODSKf1lJcZ-tnN8Bf0pbp6z4

This basically means Sign in with Google will not be possible in Open Grind on Android and Windows. For other platforms (macOS, iOS and most likely Linux), Sign in with Google works fine through WebKit's WebView.

Updates on Android (and potentially Windows) platforms specifically: 1. Grindr Web's web OAuth flow in Chromium is a dead-end. Not possible to customize Android/Chromium enough to trick Google servers to see WebView as a real web browser. [See X-Requested-With header discussion](https://groups.google.com/a/chromium.org/g/blink-dev/c/Z70s8CQ8PbU/m/jsRAEiCXAQAJ). 2. Native Android flow which is rendered for adding accounts in the phone settings is also a dead-end. Not possible to compute the required DroidGuard device attestation token without downloading & executing a proprietary rapidly-changing VM and a per-request-generated proprietary bytecode for it in the same process as Open Grind. [See microG discussion](https://github.com/microg/GmsCore/issues/214#issuecomment-2040272095). 3. The only remaining route are hacky workarounds requiring configuration and setup on user's side: - Firefox for Android browser with a browser extension - Signing in with Google in Open Grind for Linux/macOS/iOS - Rooted Android to access the official Grindr app's storage and retrieve Grindr API session token from there Discussion in Matrix: https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$1NTT0PTZ1a2NMTnyB-8qae5VOL7zGbLhhr3L88mTxCo https://matrix.to/#/!6A0aN28yRLpX1K8aLtfJWm87DXoyyMGjkPeORakOBZg/$U1rIHAFR-LIfUuDyh3tODSKf1lJcZ-tnN8Bf0pbp6z4 **This basically means Sign in with Google will not be possible in Open Grind on Android and Windows.** For other platforms (macOS, iOS and most likely Linux), Sign in with Google works fine through WebKit's WebView.

hloth commented

2026-06-30 16:57:40 +02:00

Author

Owner

Official source:
https://developer.android.com/reference/androidx/webkit/WebSettingsCompat

The origin trial to disable the X-Requested-With feature has ended, so this API now just returns an empty set.

X-Requested-With was deprecated in 2023 and undeprecated in ~2025.

Official source: https://developer.android.com/reference/androidx/webkit/WebSettingsCompat > The origin trial to disable the X-Requested-With feature has ended, so this API now just returns an empty set. X-Requested-With was deprecated in 2023 and undeprecated in ~2025.

hloth commented

2026-07-01 17:07:09 +02:00

Author

Owner

See https://git.opengrind.org/open-grind/grindr-google-oauth-webextension and https://git.opengrind.org/open-grind/open-grind-google-oauth-android-app

hloth referenced this issue from a commit

2026-07-04 03:18:48 +02:00

Add sign in with Google for Android (closes #27)

hloth referenced this issue from a pull request that will close it,

2026-07-04 03:51:48 +02:00

Sign in with Google #191

hloth closed this issue