Cross-Origin-Opener-Policy policy would block the window.closed call error while using google auth #51135
Replies: 62 comments 77 replies
-
|
Have this same problem too. Thanks for opening mr-chandan. |
Beta Was this translation helpful? Give feedback.
-
|
Haven't found a solution yet. If I do, I will be sure to post.
…On Mon, Jun 12, 2023 at 7:52 AM Chandan H ***@***.***> wrote:
Did you find any solutions ? Do share it
—
Reply to this email directly, view it on GitHub
<#51135 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACYRHNHFAMC5EZZABVQJU2DXK4UMXANCNFSM6AAAAAAZCOVSVI>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
stuck in same prob :( |
Beta Was this translation helpful? Give feedback.
-
|
I got this while running it locally, is this your case as well? |
Beta Was this translation helpful? Give feedback.
-
|
I have also encountered this issue, followed by another one, also appearing twice:
From what I was able to debug, it originates from the pop-up's iframe,
Apparently the iframe is trying to make contact with the parent window for some reason I was unable to determine. In my case, errors are beeing thrown exactly after the execution of this line, with a.i set to true. Only suggested solutions i have come across suggested adding appropriate headers on my side, but including them in my nginx server configuration didn't help at all. I don't quite understand how would it be possibble for the OAuth iframe to communicate with its parent window while it most likely implements server-wide "same-origin" header for COOP (at least with all the other requests I was able to notice). |
Beta Was this translation helpful? Give feedback.
-
|
Same issue... Please help @ijjk @tianenpang @Timer @huozhi @shibe23 |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone found the solution?? |
Beta Was this translation helpful? Give feedback.
-
|
@everyone on the thread I've solved inspect your code flow once and if you still face any issues, I'll be happy to help |
Beta Was this translation helpful? Give feedback.
-
|
Having the same issue and after some searches this code works for me. Write the code in next.config.js. Also, if I am opening the dev server on opera, I am not getting any errors. but still getting another error. |
Beta Was this translation helpful? Give feedback.
-
|
Also problem... here :/ |
Beta Was this translation helpful? Give feedback.
-
|
me too |
Beta Was this translation helpful? Give feedback.
-
|
Yes I get the errors yet it is not blocking the sign up flow. Before the
errors were blocking the flow. Yet still want to find a fix.
…On Wed, Jun 14, 2023 at 9:33 PM Abhishek Das ***@***.***> wrote:
@osaidfaisal12 <https://github.com/osaidfaisal12> u r still getting that
error?
—
Reply to this email directly, view it on GitHub
<#51135 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACYRHNCCEZ4JPAWJ7NDMETLXLKGBHANCNFSM6AAAAAAZCOVSVI>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
hi, |
Beta Was this translation helpful? Give feedback.
-
|
i has that issue too. anyone know the solution? |
Beta Was this translation helpful? Give feedback.
-
|
Just started happening to me using JavaScript, my solution was to remove the popup flow and worked like a charm: also in Firebase ui documentation. |
Beta Was this translation helpful? Give feedback.
-
|
Guy's try to lookup for the URL. In my case i trying to call a different url. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
const provider = new GoogleAuthProvider(); // Use 'GoogleAuthProvider' directly |
Beta Was this translation helpful? Give feedback.
-
|
I tried all of the above mentioned solutions one by one and also combining them also doesn't work. for context I am using Angular 17 and the authentication signinWithPopup and for firebase i am using @angular/fire packages |
Beta Was this translation helpful? Give feedback.
-
|
Hey, I faced the same issue while working with React and Google Auth. Here's how I resolved it :
I still get the Cross-Origin error at times but the sign-in goes through. |
Beta Was this translation helpful? Give feedback.
-
|
Docs link which you can refer https://firebase.google.com/docs/auth/web/redirect-best-practices?hl=en&authuser=0 |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Hi, my solution: in my const nextConfig = {
async headers() {
return [
{
source: "/(.*)",
headers: [
{
key: "Cross-Origin-Opener-Policy",
value: "same-origin",
},
],
},
];
},
};this solve the Cross-Origin-Opener-Policy error. If your start to receive the await signInWithPopup(auth, provider)
.then(async (data) => {
// some code
})
.catch((error) => console.log(error)); |
Beta Was this translation helpful? Give feedback.
-
|
I think i have found the solution, i saw a comment that suggested what might be wrong. So, if a user is logged in already, you wont be able to login there. i am not sure, but I think this happens if only one google account is available. I logged another account to my device and it works now. And to be sure, I checked if a user is logged in with onAuthStateChanged and it shows someone is logged in already. I'm certain someone will need this. You're welcome |
Beta Was this translation helpful? Give feedback.
-
|
If signin is not working, I recommend you remove any COOP/COEP headers you may have added (these may actually make the problem worse), and then carefully review this document: https://firebase.google.com/docs/auth/web/redirect-best-practices The latest browsers prevent access to cookies and shared storage from outside the current origin. The document explains how to work around that so the Firebase Once you've done this,
We believe this is being caused by a report-only Cross-Origin-Opener-Policy header that is currently sent back by This collects data on the issue and logs the error. It appears to be safe to ignore for the time being. There is no actual solution to this problem at the present time. A very good discussion with figures covering this use-case can be found here: https://github.com/hemeryar/coi-with-popups In short, I recommend:
How to detect if you're on mobile: These procedures work in our environment. You do also have to be sure to put the URL where your page is hosted into the Firebase authorized domains list in the Firebase console, and set the auth domain correctly in your Firebase configuration object. These steps are covered in the Google document. I do not believe this error message has anything to do with attempting to sign in while already signed in. I can do that any time. The issue doesn't have anything to do with account linking. If the the signin popup hangs (you get a timeout error), then it's not working correctly. Communication between the Google signin code and the Firebase auth helper that called it may be blocked, possibly by sending an inappropriate /end of comment/ |
Beta Was this translation helpful? Give feedback.
-
|
Everything is working well by me, despite the error is still out there! |
Beta Was this translation helpful? Give feedback.
-
|
Okay, so this usually happens when you're not using the same-origin-allow-popups, here is an article that describes it well. https://andrewlock.net/understanding-security-headers-part-1-cross-origin-opener-policy-preventing-attacks-from-popups/ |
Beta Was this translation helpful? Give feedback.
-
|
you may add this : like this: however you may want to use package, for react the best one at this point would be @react-oauth/google. If you decided to use the indicated package, the erros will presists, but it will work anyway |
Beta Was this translation helpful? Give feedback.
-
|
I mean if it works, it works ig.
…On Mon, Apr 21, 2025 at 10:39 AM Liviu Şoşu ***@***.***> wrote:
you may add this :
data-use_fedcm_for_prompt="true"
data-use_fedcm_for_button="true"
like this:
<div>
<div id="g_id_onload"
data-client_id=":-)"
data-context="signin"
data-ux_mode="redirect"
data-login_uri="https://localhost:7133/ExternalLogin/googleLogin"
**data-auto_select="true"**
**data-itp_support="true"**>
</div>
<div className="g_id_signin"
data-type="icon"
data-shape="square"
data-theme="outline"
data-text="signin_with"
data-size="large">
</div>
</div>
however you may want to *use package*, for react the best one at this
point would be ***@***.***/google*. If you decided to use the indicated
package, the erros will presists, but it will work anyway
—
Reply to this email directly, view it on GitHub
<#51135 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AQSJHI7N5L2Z7CMXIEK6BNT22T7KJAVCNFSM6AAAAAAZCOVSVKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEOBZHE2DAMY>
.
You are receiving this because you commented.Message ID: <vercel/next.
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
I have this error but it doesn't cause any issues in my flow using pkg: @capacitor-firebase/authentication (Capacitor + NextJS + Firebase Auth). I am reading these comments when Google was having outages and causing issues with sign in - where accounts selection was lagging or timing out big time. |
Beta Was this translation helpful? Give feedback.




Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Summary
I am using next, firebase and its google auth tool, everything works fine the user data is getting saved in the database but i get a error every time the popup window appears (Cross-Origin-Opener-Policy policy would block the window.closed call)


Additional information
No response
Example
No response
Beta Was this translation helpful? Give feedback.
All reactions