title: Why does Android Chrome update from 61.0.3163.98 to 72.0.3626.76 break OAuth login in Chrome Custom Tabs?
body: <p>Our production Android application uses Chrome Custom Tabs for OAuth login</p>
  
  <p>It was working fine yesterday when Chrome version was 61.0.3163.98</p>
  
  <p>Following an overnight update of Chrome to 72.0.3626.76 the Login process gets stuck in the embedded browser and the user is presented with a blank white screen.</p>
  
  <p>If we uninstall the Chrome update the login starts to work again</p>
  
  <p>What has changed with Chrome and/or Chrome Custom Tabs that breaks our login process?</p>
  
  <p>If I switch my default browser to Firefox my apps login works fine.</p>
  
  <p>In fact if I change default browser to anything other than chrome it works fine, even Opera works, although Opera doesnt show an embedded browser.</p>
  
  <p>It also works when I uninstall the Chrome update and revert back to chrome version 61.0.3163.98</p>
  
  <p>Further Details:-</p>
  
  <pre><code>Step 1). Load URL with prompt=none and my custom scheme Redirect URL.
  Step 2). My App receives a NEW INTENT containing the auth code.
  Step 3). I attempt to access my back end APIs with this code, which fails with 400
  Step 4). Load URL prompt=login and my users are presented with a sign in screen where they enter their credentials and click on the Sign In button.
  Step 5). NOTHING HAPPENS, the user is presented with a blank screen, my app does not receive a NEW INTENT.
  </code></pre>
  
  <p>Heres the code I employ to open the Login URL via a Chrome Custom Tab</p>
  
  <pre><code>private void openCustomTab() {
      codeVerifier = generateRandomCodeVerifier();
      checkCodeVerifier(codeVerifier);
      codeChallenge = deriveCodeVerifierChallenge(codeVerifier);
  
      CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
      CustomTabsIntent customTabsIntent = builder.build();
      customTabsIntent.launchUrl(this, getURL(PROMPT_NONE));
  }
  </code></pre>
  
  <p>The above code loads the URL with prompt=none and it also specifies my custom scheme redirect url.</p>
  
  <p>My Android app receives a New Intent in onNewIntent that contains an authCode, I attempt to retrieve an access token with this authocode which fails with 400.</p>
  
  <p>I then use custom Tabs to load a second URL with prompt=login as follows:-</p>
  
  <pre><code>            final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
              builder.setToolbarColor(Color.BLUE);
  
              final CustomTabsIntent customTabsIntent = builder.build();
              customTabsIntent.launchUrl(SignInActivity.this, getURL(PROMPT_LOGIN, authCode));
  </code></pre>
  
  <p>By loading this URL with prompt=login the user can enter their credentials and click on the Sign In button.</p>
  
  <p>Its at this point the Chrome Custom Tab gets stuck.</p>
  
  <p>here are the network calls I capture using Stetho, the last call made is authorization.ping that shows as cancelled</p>
  
  <p><a href="https://i.stack.imgur.com/0BTe8.png" rel="noreferrer"><img src="https://i.stack.imgur.com/0BTe8.png" alt="enter image description here"></a></p>
  
  <p>I have found a resolution for this issue as follows:-</p>
  
  <p>I added an additional prompt of "consent" to the existing prompts of "none" then "login".</p>
  
  <p>Now the user see a consent screen titled </p>
  
  <pre><code>oauth.approval.page.template.title
  </code></pre>
  
  <p>where the user sees a list of choosable options including</p>
  
  <pre><code>ACCESS TO YOUR DATA
  SIGN IN WITH OPENID CONNECT
  OPENID CONNECT PROFILE SCOPE
  OPENID CONNECT EMAIL SCOPE
  </code></pre>
  
  <p>at the bottom of this screen theres two options</p>
  
  <pre><code>oauth.approval.page.template.allow
  oauth.approval.page.template.dontAllow
  </code></pre>
  
  <p>when the user selects</p>
  
  <pre><code>oauth.approval.page.template.allow
  </code></pre>
  
  <p>they can now proceed into the android app.</p>
  
  <p>The only issue is the user sees this approval screen whenever they log in</p>