[OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:] crash

[sschizas]

Describe the bug
An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed. - An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed.

To Reproduce
Fatal Exception: An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed.
0 CoreFoundation 0x11a21c __exceptionPreprocess
1 libobjc.A.dylib 0x31abc objc_exception_throw
2 CoreFoundation 0x178ea0 -[NSException initWithCoder:]
3 Blueground 0x37ef5c -[OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:] + 137 (OIDAuthorizationService.m:137)
4 Blueground 0x372eb0 -[GIDSignIn handleURL:] + 200 (GIDSignIn.m:200)
5 Blueground 0x366ca8 protocol witness for GoogleSignInProvider.handle(:) in conformance GIDSignIn ()
6 Blueground 0x366b74 @objc GoogleSignInService.application(:open:options:) + 21 (GoogleSignInService.swift:21)
7 Blueground 0x1ae3a0 AppDelegate.application(:open:options:) + 224 (AppDelegate.swift:224)
8 Blueground 0x1ae604 @objc AppDelegate.application(:open:options:) ()
9 Blueground 0x4a2d60 -[GULAppDelegateSwizzler application:openURL:options:] + 698 (GULAppDelegateSwizzler.m:698)
10 UIKitCore 0x1189c8c __58-[UIApplication _applicationOpenURLAction:payload:origin:]_block_invoke
11 UIKitCore 0x11896e0 -[UIApplication _applicationOpenURLAction:payload:origin:]
12 UIKitCore 0x163c35c -[_UIOpenURLApplicationBSActionHandler _respondToApplicationActions:fromTransitionContext:]
13 UIKitCore 0x238ffc -[UIApplication _handleNonLaunchSpecificActions:forScene:withTransitionContext:completion:]
14 UIKitCore 0x16bc48 -[UIScene _emitSceneSettingsUpdateResponseForCompletion:afterSceneUpdateWork:]
15 UIKitCore 0x16b9f4 -[UIScene scene:didUpdateWithDiff:transitionContext:completion:]
16 UIKitCore 0x2c43e0 -[UIApplicationSceneClientAgent scene:handleEvent:withCompletion:]
17 FrontBoardServices 0x24094 __76-[FBSScene updater:didUpdateSettings:withDiff:transitionContext:completion:]_block_invoke.146
18 FrontBoardServices 0x1f6fc -[FBSScene _callOutQueue_coalesceClientSettingsUpdates:]
19 FrontBoardServices 0x23dc0 -[FBSScene updater:didUpdateSettings:withDiff:transitionContext:completion:]
20 FrontBoardServices 0x26ca0 __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke_2
21 FrontBoardServices 0x1ed38 -[FBSWorkspace _calloutQueue_executeCalloutFromSource:withBlock:]
22 FrontBoardServices 0x26bcc __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke.cold.1
23 FrontBoardServices 0x26a40 __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke
24 libdispatch.dylib 0x1b584 _dispatch_client_callout
25 libdispatch.dylib 0x6ab0 _dispatch_block_invoke_direct
26 FrontBoardServices 0x1e8ac FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK
27 FrontBoardServices 0x1e748 -[FBSMainRunLoopSerialQueue _targetQueue_performNextIfPossible]
28 FrontBoardServices 0x1e7b0 -[FBSMainRunLoopSerialQueue _performNextFromRunLoopSource]
29 CoreFoundation 0xfa8c CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION
30 CoreFoundation 0xf8a4 __CFRunLoopDoSource0
31 CoreFoundation 0xf700 __CFRunLoopDoSources0
32 CoreFoundation 0x10080 __CFRunLoopRun
33 CoreFoundation 0x11c3c CFRunLoopRunSpecific
34 GraphicsServices 0x1454 GSEventRunModal
35 UIKitCore 0x135274 -[UIApplication _run]
36 UIKitCore 0x100a28 UIApplicationMain
37 UIKitCore 0x1e2168 __51-[UIStatusBar_Base _setHidden:animationParameters:]_block_invoke_4
38 Blueground 0x1af440 main (AppDelegate.swift)
39 ??? 0x1aaf1ff08 (Missing)

Expected behavior
Not to crash.

Environment

• Device: Iphone
• OS: iOS 18.x
• Google Sign-in SDK: v 9.0

[balavor]

We are getting the same crash after migrating from 6.2.4 to 9.0.0.

[lalazhuzhu]

we met the same issue after migrating from 6.2.4 to 9.0.0.

[brnnmrls]

Thanks for the reports! To help us understand the severity of this crash, can you let us know how often it's happening?

The error "An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed" suggests there could be some race condition where our handleURL: method is called multiple times for the same sign-in attempt. This appears to be an intermittent issue that is difficult to reproduce. I did take a look at our releases, but nothing strongly stuck out as the issue to me.

Any additional details about your project setup, especially other SDKs you are using that might also handle URL redirects, could be helpful.

[sschizas]

@brnnmrls, it crashes often daily. Also, the only solution is to use 8.x SDK version instead of 9.x, which has this bug. Take a look into OpenID SDK as 9.x uses the OpenID 2.x version where 8.x uses a older version.

[mzying2013]

we met the same issue after migrating from 8.0.0 to 9.0.0.

[greymag]

Same issue after after migrating from 7.1.0 to 9.0.0

[camden-king]

Can you please provide additional information on how/when you integrating with GSI are calling GIDSignIn handleURL.

If you are able to provide repro steps using the DaysUntilBirthday example app or a recording of it happening that would be ideal.

[therohansanap]

@camden-king If this help in understanding the crash - MaikuB/flutter_appauth#552

[joannetsaii]

After some investigation the team believes that this crash only happens when the sign-in is done in an external browser. However we also could not reproduce the issue by forcing a sign-in flow from an external browser (e.g. copying and pasting the URL into an external browser). To help us understand the issue better:

1. Could you let us know how exactly the user is completing the sign-in flow? If there are repro steps, that would be great.
2. To test this - are you able to force sign-in via an external browser from your apps by modifying the logic in AppAuth (if this is possible)?