Login request crash #505

Activity

1. zhengyipei

   added

   bugSomething isn't workingSomething isn't working

   triageIssues that need to be triagedIssues that need to be triaged

   on Feb 25, 2025
2. brnnmrls

   removed

   triageIssues that need to be triagedIssues that need to be triaged

   on Mar 4, 2025
3. brnnmrls commented on Mar 4, 2025

   

   brnnmrls

   on Mar 4, 2025

   Member

   More actions

   Hi! Looking for more context. Would you happen to know what the type(s) of the value you're getting is? Do you have any guesses on what cases specifically may return a different type?
4. aforkalyuk commented on Mar 6, 2025

   

   aforkalyuk

   on Mar 6, 2025

   More actions

   private func authorizeRequest(withArguments args: AuthorizationArguments) {
       serialAuthArgsQueue.sync {
         authorizationArgs.append(args)
       }
       let additionalRefreshParameters = delegate?.additionalTokenRefreshParameters?(
         forAuthSession: self
       )
   

   @objc optional func additionalTokenRefreshParameters(
       forAuthSession authSession: AuthSession
     ) -> [String: String]?
   

   additionalTokenRefreshParameters must return [String: String]?, but in

   [GIDEMMSupport updatedEMMParametersWithParameters: authSession.authState.lastTokenResponse.additionalParameters]

   authSession.authState.lastTokenResponse.additionalParameters =

   {
   "refresh_token_expires_in" = 604799;
   }
5. onewOne commented on Jul 10, 2025

   

   onewOne

   on Jul 10, 2025

   More actions

   Unreviewed apps with scope for login will have this issue.

   App review doesn't crash.

   My guess is that the scope authorization for unaudited apps has an expiration time, but this time is not officially handled as a string type.
6. brnnmrls

   linked a pull request that will close this issueEnsure `additionalTokenRefreshParametersForAuthSession` returns a string dictionary #559on Oct 1, 2025
7. Aloisius commented on Oct 20, 2025

   

   Aloisius

   on Oct 20, 2025

   Last edited by Aloisius

   More actions

   The fix #559 by @brnnmrls will still crash if emmSupport is disabled, because the dictionary passed in that is returned in if emmSupport is null can have the "refresh_token_expires_in" = long_value in it:

   + (NSDictionary<NSString *,NSString *> *)parametersWithParameters:(NSDictionary *)parameters
                                                          emmSupport:(nullable NSString *)emmSupport
                                              isPasscodeInfoRequired:(BOOL)isPasscodeInfoRequired {
     if (!emmSupport) {
       return parameters;
     }
     ...
   

   Changing this to return [GIDEMMSupport dictionaryWithStringValuesFromDictionary:parameters] instead fixes it.
8. AkshatG6

   closed this as completedin #564on Nov 7, 2025
9. AkshatG6 commented on Jan 15, 2026

   

   AkshatG6

   on Jan 15, 2026

   Last edited by AkshatG6

   Contributor

   More actions

   Hi, this issue is fixed in Google Sign-In iOS SDK version 9.1.0.
10. onewOne commented on Jun 4, 2026

    

    onewOne

    on Jun 4, 2026

    More actions

    Hi, this issue is fixed in Google Sign-In iOS SDK version 9.1.0.

    Title: GIDEMMSupport can still return non-string additional token refresh parameters from lastTokenResponse.additionalParameters

    Environment

    • GoogleSignIn: 9.1.0
    • AppAuth: 2.0.0
    • GTMAppAuth: 5.0.0
    • Platform: iOS

    Problem

    GIDEMMSupport appears to have added filtering via dictionaryWithStringValuesFromDictionary: to ensure EMM parameters are returned as NSDictionary<NSString *, NSString *>.

    However, this does not fully cover the case where no emm_support value exists.

    Current flow:

    - (nullable NSDictionary<NSString *,NSString *> *)
    additionalTokenRefreshParametersForAuthSession:(GTMAuthSession *)authSession {
      return [GIDEMMSupport updatedEMMParametersWithParameters:
              authSession.authState.lastTokenResponse.additionalParameters];
    }
    Then:
    
    + (NSDictionary<NSString *,NSString *> *)parametersWithParameters:(NSDictionary *)parameters
                                                           emmSupport:(nullable NSString *)emmSupport
                                               isPasscodeInfoRequired:(BOOL)isPasscodeInfoRequired {
      if (!emmSupport) {
        return parameters;
      }
    
      NSMutableDictionary *allParameters = [(parameters ?: @{}) mutableCopy];
      ...
      return [GIDEMMSupport dictionaryWithStringValuesFromDictionary:allParameters];
    }
    When emmSupport is nil, the method returns parameters directly. But authSession.authState.lastTokenResponse.additionalParameters comes from OIDTokenResponse.additionalParameters, whose type is not guaranteed to be NSDictionary<NSString *, NSString *>; it may contain non-string JSON values such as dictionaries, arrays, booleans, numbers, or null-like values.
    
    As a result, additionalTokenRefreshParametersForAuthSession: can still return a dictionary containing non-string values, despite its declared return type being:
    
    NSDictionary<NSString *, NSString *> *
    Expected Behavior
    updatedEMMParametersWithParameters: / parametersWithParameters:emmSupport:isPasscodeInfoRequired: should always return a string-only dictionary, including the early-return path where emmSupport is nil.
    
    Suggested Fix
    Change:
    
    if (!emmSupport) {
      return parameters;
    }
    to:
    
    if (!emmSupport) {
      return [GIDEMMSupport dictionaryWithStringValuesFromDictionary:(parameters ?: @{})];
    }
    This makes the behavior consistent with the later return path and prevents non-string values from being returned through the GTMAuthSessionDelegate additional token refresh parameters API.