Repository navigation
[OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:] crash #547
Description
Describe the bug
An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed. - An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed.
To Reproduce
Fatal Exception: An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed.
0 CoreFoundation 0x11a21c __exceptionPreprocess
1 libobjc.A.dylib 0x31abc objc_exception_throw
2 CoreFoundation 0x178ea0 -[NSException initWithCoder:]
3 Blueground 0x37ef5c -[OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:] + 137 (OIDAuthorizationService.m:137)
4 Blueground 0x372eb0 -[GIDSignIn handleURL:] + 200 (GIDSignIn.m:200)
5 Blueground 0x366ca8 protocol witness for GoogleSignInProvider.handle(:) in conformance GIDSignIn ()
6 Blueground 0x366b74 @objc GoogleSignInService.application(:open:options:) + 21 (GoogleSignInService.swift:21)
7 Blueground 0x1ae3a0 AppDelegate.application(:open:options:) + 224 (AppDelegate.swift:224)
8 Blueground 0x1ae604 @objc AppDelegate.application(:open:options:) ()
9 Blueground 0x4a2d60 -[GULAppDelegateSwizzler application:openURL:options:] + 698 (GULAppDelegateSwizzler.m:698)
10 UIKitCore 0x1189c8c __58-[UIApplication _applicationOpenURLAction:payload:origin:]_block_invoke
11 UIKitCore 0x11896e0 -[UIApplication _applicationOpenURLAction:payload:origin:]
12 UIKitCore 0x163c35c -[_UIOpenURLApplicationBSActionHandler _respondToApplicationActions:fromTransitionContext:]
13 UIKitCore 0x238ffc -[UIApplication _handleNonLaunchSpecificActions:forScene:withTransitionContext:completion:]
14 UIKitCore 0x16bc48 -[UIScene _emitSceneSettingsUpdateResponseForCompletion:afterSceneUpdateWork:]
15 UIKitCore 0x16b9f4 -[UIScene scene:didUpdateWithDiff:transitionContext:completion:]
16 UIKitCore 0x2c43e0 -[UIApplicationSceneClientAgent scene:handleEvent:withCompletion:]
17 FrontBoardServices 0x24094 __76-[FBSScene updater:didUpdateSettings:withDiff:transitionContext:completion:]_block_invoke.146
18 FrontBoardServices 0x1f6fc -[FBSScene _callOutQueue_coalesceClientSettingsUpdates:]
19 FrontBoardServices 0x23dc0 -[FBSScene updater:didUpdateSettings:withDiff:transitionContext:completion:]
20 FrontBoardServices 0x26ca0 __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke_2
21 FrontBoardServices 0x1ed38 -[FBSWorkspace _calloutQueue_executeCalloutFromSource:withBlock:]
22 FrontBoardServices 0x26bcc __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke.cold.1
23 FrontBoardServices 0x26a40 __94-[FBSWorkspaceScenesClient _queue_updateScene:withSettings:diff:transitionContext:completion:]_block_invoke
24 libdispatch.dylib 0x1b584 _dispatch_client_callout
25 libdispatch.dylib 0x6ab0 _dispatch_block_invoke_direct
26 FrontBoardServices 0x1e8ac FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK
27 FrontBoardServices 0x1e748 -[FBSMainRunLoopSerialQueue _targetQueue_performNextIfPossible]
28 FrontBoardServices 0x1e7b0 -[FBSMainRunLoopSerialQueue _performNextFromRunLoopSource]
29 CoreFoundation 0xfa8c CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION
30 CoreFoundation 0xf8a4 __CFRunLoopDoSource0
31 CoreFoundation 0xf700 __CFRunLoopDoSources0
32 CoreFoundation 0x10080 __CFRunLoopRun
33 CoreFoundation 0x11c3c CFRunLoopRunSpecific
34 GraphicsServices 0x1454 GSEventRunModal
35 UIKitCore 0x135274 -[UIApplication _run]
36 UIKitCore 0x100a28 UIApplicationMain
37 UIKitCore 0x1e2168 __51-[UIStatusBar_Base _setHidden:animationParameters:]_block_invoke_4
38 Blueground 0x1af440 main (AppDelegate.swift)
39 ??? 0x1aaf1ff08 (Missing)
Expected behavior
Not to crash.
Environment
- Device: Iphone
- OS: iOS 18.x
- Google Sign-in SDK: v 9.0
Activity
[-][OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:][/-][+][OIDAuthorizationSession resumeExternalUserAgentFlowWithURL:] crash[/+]balavor commentedon Aug 25, 2025
We are getting the same crash after migrating from 6.2.4 to 9.0.0.
lalazhuzhu commentedon Sep 12, 2025
we met the same issue after migrating from 6.2.4 to 9.0.0.
brnnmrls commentedon Sep 13, 2025
Thanks for the reports! To help us understand the severity of this crash, can you let us know how often it's happening?
The error "An OAuth redirect was sent to a OIDExternalUserAgentSession after it already completed" suggests there could be some race condition where our handleURL: method is called multiple times for the same sign-in attempt. This appears to be an intermittent issue that is difficult to reproduce. I did take a look at our releases, but nothing strongly stuck out as the issue to me.
Any additional details about your project setup, especially other SDKs you are using that might also handle URL redirects, could be helpful.
sschizas commentedon Sep 13, 2025
@brnnmrls, it crashes often daily. Also, the only solution is to use 8.x SDK version instead of 9.x, which has this bug. Take a look into OpenID SDK as 9.x uses the OpenID 2.x version where 8.x uses a older version.
mzying2013 commentedon Sep 17, 2025
we met the same issue after migrating from 8.0.0 to 9.0.0.
greymag commentedon Sep 17, 2025
Same issue after after migrating from 7.1.0 to 9.0.0
camden-king commentedon Sep 19, 2025
Can you please provide additional information on how/when you integrating with GSI are calling
GIDSignIn handleURL.If you are able to provide repro steps using the DaysUntilBirthday example app or a recording of it happening that would be ideal.
therohansanap commentedon Sep 23, 2025
@camden-king If this help in understanding the crash - MaikuB/flutter_appauth#552
joannetsaii commentedon Oct 1, 2025
After some investigation the team believes that this crash only happens when the sign-in is done in an external browser. However we also could not reproduce the issue by forcing a sign-in flow from an external browser (e.g. copying and pasting the URL into an external browser). To help us understand the issue better:
balavor commentedon Oct 2, 2025
@joannetsaii, I might not be able to test this, but it’s highly likely for enterprise customers using managed devices where SSO is only available via Microsoft Edge. 🫠
I don't know what exactly flow looks like, but I know such a use case exists and we received reports before about such limitations that users have on their phones.
luisendelgado commentedon Oct 7, 2025
We suspect this crash occurs when the sign-in flow falls back to an external browser after
ASWebAuthenticationSessionfails to open. We’ve had difficulty reproducing it consistently.To help us debug, could you please set the following breakpoints in
AppAuth'sOIDExternalUserAgentIOS.mand share what you find?presentAuthorizationRequest:session:.[_asWebAuthenticationSession start]call.return [self presentExternalUserAgentRequest:request session:session];line in theelseblock.Please let us know which breakpoints are hit and in what order. Any details on variable values at those points would be very helpful. Thanks for your help
8 remaining items
camden-king commentedon Oct 30, 2025
@Chiratna are you able to reproduce this yourself using a react native app? If so can you please provide repro steps and ideally a sample app.
Also is everyone experiencing this issue using a react native app or is it both react native and iOS implemented?
yishair-investing commentedon Oct 30, 2025
@camden-king we experienced this issue in production with our native iOS app. Have now reverted back to 8.x.x so no longer experience the crashes.
mengqutaoyuan commentedon Nov 3, 2025
we experienced this issue in production with our native iOS app. Have now reverted back to 8.x.x so no longer experience the crashes.
sschizas commentedon Nov 4, 2025
We are using native iOS SDK.
anushshenoy commentedon Nov 23, 2025
We are seeing this crash in production for some time now in our native iOS app using v9.0.0 of the SDK. Any updates on whether this can be addressed and any ETA on the same?
anushshenoy commentedon Dec 2, 2025
@mdmathias @brnnmrls @camden-king request your help here with this production crash
camden-king commentedon Dec 16, 2025
Hello everyone,
Thank you for the detailed reports and patience as we investigated this issue.
We have been able to recreate this crash in two ways mentioned above:
We are planning to implement the following changes in GoogleSignIn-iOS and AppAuth-iOS to prevent crashes in the flows mentioned above.
We plan to have a fix out sometime early in 2026. In the meantime we recommend wrapping -[GIDSignIn handleURL:] in a do/catch block. Lastly, we would welcome external contributions towards fixing this bug.
trant commentedon Dec 16, 2025
We are seeing this on our app as well for version
7.1.0on users running the app oniPad OS 18.7.0.sschizas commentedon Jan 15, 2026
@camden-king any updates about the ETA of this bug fix?
bsudekum commentedon Jan 30, 2026
@camden-king can we get #556 merged?
tahirghaffar1380-source commentedon Jan 31, 2026
yishair-investing commentedon Jun 8, 2026
Has this been fixed in 9.1.0?
balavor commentedon Oct 12, 2026
Hey @brnnmrls, @camden-king,
Any updates on this issue? I haven't seen any updates on this issue. This harms many enterprise customers relying on external browsers, preventing us from updating the SDK version to the latest one.
camden-king commentedon Oct 12, 2026
Hi @balavor (and everyone following this issue),
Apologies for the delayed update on this thread — this crash was fixed in GoogleSignIn-iOS 9.2.0 (and is also included in 10.0.0), which updated our
AppAuth-iOSdependency to 2.1.0+.Specifically, the fix included:
ASWebAuthenticationSessionfails to start (e.g., when rapidly tapping the sign-in button), failing the flow with an error instead.resumeExternalUserAgentFlowWithURL:error:(and updated the deprecatedresumeExternalUserAgentFlowWithURL:) to returnNOinstead of throwingOIDOAuthExceptionInvalidAuthorizationFlowwhen a redirect URL is received after a session has already completed or been canceled.AppAuthdependency to2.1.0and adoptedresumeExternalUserAgentFlowWithURL:error:in-[GIDSignIn handleURL:].Note on external browsers:
GoogleSignIn-iOS only officially supports authentication via
ASWebAuthenticationSession. If a user manually opens the sign-in URL in an external browser:ASWebAuthenticationSessionsheet before redirecting back to the app, closing the sheet cancels the active session; with9.2.0+, the subsequent redirect from the external browser will safely returnNOfrom-[GIDSignIn handleURL:]instead of crashing.ASWebAuthenticationSessionsheet is left open in the background while completing sign-in in the external browser, the redirect back to the app will still complete the sign-in flow.Please upgrade to GoogleSignIn-iOS 9.2.0 (or 10.0.0) and let us know if you still encounter this issue!
balavor commentedon Oct 12, 2026
Thank you, @camden-king, for the update. Will move on with 9.2.0.
BTW, regarding 10.0.0, would you consider attaching xcframeworks to releases in this repo instead of Firebase? LMK if that's not on the radar yet and I'd come up with a new issue.