How do you handle popups in Tauri?

[elanzini]

I am trying to implement Google OAuth 2.0 flow from my Tauri application. I am getting stuck because the application does not allow popups - error:"popup_blocked_by_browser".

1. Does Tauri by design not allow popups?
2. Is there a way to handle them in the framework?
3. More specifically to OAuth 2.0, what would be the redirect_uri to use to redirect to the desktop application?

[FabianLars]

popups won't be actual tauri windows, but something the webviews handle internally. At least WebView2 (Windows) can handle popups in theory, but it seems to be a little random when it opens them and when not - or maybe it depends on how the popup is request or whatever 🤔

Another problem is that google forbids oauth in non-browser environments, so even after the popup opens, it should show a on-screen warning. For what it's worth you can prevent that warning by changing the user agent - at least until google figures out a better way to filter out webviews.

redirect_uris are tricky too, realistically you can't redirect to the actual tauri app (tauri:// and https://tauri.localhost/), primarily because it will break the access to Tauri APIs and i think google doesn't allow non-http schemes either but i could be wrong.
I don't know if there are workarounds, but from what i've seen so far you'll need a localhost listener at which point you may as well follow the recommendation and let the user log in in their default browser 🤷

[elanzini]

I am just importing use tauri::*; above and then there is no other import/definition in the file.

[FabianLars]

Yeah no, can't recommend * imports at all in Rust.
The problem in this case is that you're importing tauri::Result which overwrites the std Result type.

If you wanna keep using this kind of imports then you could make the function return value more specific: std::result::Result

[elanzini]

That was indeed the solution. Thanks a lot. Sorry for the noob questions

[elanzini]

To piece things together, essentially, instead of opening the pop-up, I need to override the default behavior and open the link in a new tab, for example using the shell api. Then the user will click on consent and at this point, the redirect_uri will point back to localhost, which will be intercepted by the Tauri application running locally.

What if you have other things running locally on different ports?
Is it better to handle the exchange of tokens and then pass it to the application with deeplinks?

[FabianLars]

To piece things together, essentially, instead of opening the pop-up, I need to override the default behavior and open the link in a new tab, for example using the shell api. Then the user will click on consent and at this point, the redirect_uri will point back to localhost, which will be intercepted by the Tauri application running locally.

Yes.

What if you have other things running locally on different ports?

Do you mean in context of port conflicts? Nothing as the plugin chooses a random available port. Security-wise? Of course a little tricky, which is why my comments in the plugin were so harsh on validating the input. Just have in mind that the whole system can send stuff to the localhost server if it finds the point.
Edit: Ah you mean that the oauth redirect chooses the wrong application? That can't happen either, because you specify the port in the actual request, just not in the google settings.

Is it better to handle the exchange of tokens and then pass it to the application with deeplinks?

deeplinks basically have the same security complications, everything on the same system can send stuff to your app via deeplinks.

[igorjacauna]

Hi folks, just came here to say that I created this simple project that makes login on Firebase through Google OAuth 2.0. Using OAuth Tauri Plugin to help the process