title: Electron application using Google OAuth: "this browser or app may not be secure"
body: <p>A user of my app reported an issue today about authorizing the user with Google (using OAuth 2.0). So far the application was opening a new BrowserWindow (node integration disabled, session is separated from the main application). You can see the implementation <a href="https://github.com/advanced-rest-client/electron-oauth2/blob/master/lib/provider.js#L17" rel="noreferrer">here</a> since the library is OSS. I am using this to authorize the user to access application data on Google Drive.
  Today after logging in I see the following message:</p>
  <blockquote>
  <p>This browser or app may not be secure.</p>
  <p>Try using a different browser. If you’re already using a supported browser, you can refresh your screen and try again to sign in.</p>
  </blockquote>
  <p>The learn more link has a section for developers. This section has 2 links. One is how to upgrade the application to PWA. Because the application is an API testing tool it won't be possible to run it in a web browser.
  The second link points to a document describing how to migrate to authorization for native application. However described flow requires authorization_code grant. This means I need to include OAuth secret into my application. Electron application, however, is still web application and there's no notion of compiling sources. I would expose client secret to the public which is not secured. Potentially I could build a server application to support it but the app is OSS project. It does not have funding to run a server for authorization.</p>
  <p>My question is now how should I implement OAuth 2 for Electron application then. I can't use PWA's and server authorization flow (code grant) is far from ideal in this case.</p>