1904118 - account.samsung.com - browser not supported when trying to sign in through Samsung Health or Samsung SmartThings Apps, with Firefox Nightly/Beta or Chrome Dev as default browser, on a non-samsung device

Status: NEW

(Web Compatibility :: Site Reports, defect, P2)

Description

[Ksenia Berezina [:ksenia] on leave until 09/15]

Environment:
Operating system: Android 13
Originally reported Firefox version: Firefox Mobile 111.0
Last reproduced with the following UA: Mozilla/5.0 (Android 14; Mobile; rv:126.0) Gecko/126.0 Firefox/126.0
Platforms reproduced on: android

Additional notes:
when trying to login through Samsung health app (Nightly as default)

Steps to reproduce:
Login from Samsung Wear app doesn't work due to browser detection gate

Actual Behavior:
Browser unsupported

Created from https://github.com/webcompat/web-bugs/issues/117502

Comment 1

[Jeff Muizelaar [:jrmuizel]]

More detailed STR in https://github.com/webcompat/web-bugs/issues/117502#issuecomment-1412111102

Comment 2

[Dennis Schubert [:denschub]]

We're leaving this to the WebCompat team so we can check if they're trying to call some Samsung-only APIs.

Comment 3

[Vash63]

(In reply to Dennis Schubert [:denschub] from comment #2)

We're leaving this to the WebCompat team so we can check if they're trying to call some Samsung-only APIs.

I think this is somewhat missing the point. It works fine in Firefox stable on the same non-Samsung hardware. If it happens to work in Beta/Nightly on Samsung phones, that's a separate bug, not the one I reported. This should be fixable with a user agent hack to make Nightly report as Stable for the website.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

Can you confirm that the problem doesn't happen in Firefox stable but does happen in Firefox beta/nightly?

Comment 5

[Vash63]

(In reply to Jeff Muizelaar [:jrmuizel] from comment #4)

Can you confirm that the problem doesn't happen in Firefox stable but does happen in Firefox beta/nightly?

That is correct.

Comment 6

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Looks like this affects other Samsung apps, e.g. the SmartThings app per https://github.com/webcompat/web-bugs/issues/133056

(In reply to Vash63 from comment #5)

(In reply to Jeff Muizelaar [:jrmuizel] from comment #4)

Can you confirm that the problem doesn't happen in Firefox stable but does happen in Firefox beta/nightly?

That is correct.

That matches my experience and the experience shown in Calin's screencast in https://github.com/webcompat/web-bugs/issues/117502#issuecomment-1412111102 -- BUT, importantly: when you've got Firefox Release set as your default browser, the in-app sign-in page there is actually rendered using Chrome, not with Firefox. (You can verify this using the 3-dot-menu that shows up there, and by noticing that the UI is the same that shows up when you have Chrome as your default.)

So this isn't a case of Firefox Nightly/beta being specially broken, but rather them registering specially to handle whatever the in-app-browser-experience is that gets launched by the Samsung apps here, and that in-app-browser-experience being broken when we handle it for whatever reason.

Comment 7

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Let's put this in the Android team's diagnosis queue. The first question here is, why are these Samsung apps opening a nice in-app Chrome-based webview when you tap "Sign in" with Chrome or Firefox-release as your default, vs. opening a regular browser-tab when you've got Firefox beta or Nightly as your default browser?

I suspect the issue might be downstream from that question (e.g. maybe there's some extra contextual information that's being provided to the in-app browser, which is instead being dropped on the floor somehow when an external tab gets opened?)

Comment 8

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Here's a screencast showing what this looks like currently (Pixel 6a running Android 15), using SmartThings as my test app (Samsung Health behaves the same way):
https://drive.google.com/file/d/1Ruo5U4-o0HkVBO0baG0AUDFUbbSn5ZZh/view?usp=sharing

Quick overview:

• First half of screencast has Firefox 133.0.2 as my default browser. When I tap "Sign in" in SmartThings, some sort of embedded Chrome WebView gets used to render the in-app sign-in page (and it works). Nonetheless, the 3-dot menu invites me to open the page in Firefox (which it knows is my default browser), and the page works there too.
• Second half of screencast has Firefox Nightly 135.0a1 as my default browser. When I tap "Sign in" in SmartThings, I end up with a regular tab being spawned in my Firefox Nightly browser (not a "custom" in-app tab), and that tab shows me a browser-not-supported page.
• The two pages (sign-in page vs. browser-not-supported page) have nearly-the-same-URL, with only the &svcParam= query-param varying. That query-param seems to be the all-important thing that determines whether a sign-in page vs. a browser-not-supported page is shown. The "good" URL is good (looks like a sign-in page) when viewed in any browser, including on desktop; whereas the "bad" URL is bad (shows a browser-not-supported page) when viewed in any browser, including on desktop.

Here's the "good" URL:

https://account.samsung.com/accounts/ANDROIDSDK/signInGate?locale=en_US&svcParam=eyJjaGtEb051bSI6IjEiLCJzdmNFbmNQYXJhbSI6Ikt5aVFIdFI2dU5WOHpDSmErNFwvT21jUlBjR0prUlFGNFAxZFwvZ0NraWhEZE9WZ2JBb0ZENHB0aHJralc1N0hDVmdOdVB2dW1Qb1RhcmZmeWIydTN6dzNNd21rMHRkMnlSQ2N1eERUcERcL0tOYVZiUHo4TTBOMXBJSThjN1JPWHdabWtKM0N6Yk1iNW5VSWZDNGZjQWNVQkFRSGFibHlwUU1QN1d1bXcrQkJVM2N0UFExckQ2enVqb0dBZk9qRjQ5OVFoM0h2eE4xZ295c05melJrNFZxb3ZSZlVBbFNpZWdYSEtZWW5Uc0E1bFp6R2lpN1lDbm83OWx2UU5HNjhhSzY2alRmenBpV0VjbzFLb1I5UThubkVLem5rNWJCTmVuVzkzZENYTXlMd0tEY1I2aHNKWEJ1XC8zWUludldJeGpuNjZNUzZSeW42VHhxaGNYVkNVSlJ2S3lIc1RKUzQyZFpTYm9qdldqK0FOSnluUmdmZHczc3Z2Vm0ySlZnZkhONldPXC9KQUo4UGE4cm5mMFl0RVphSXNYY0NRWFBXNk1oN2FOUTlcL0JiQVpZaDdBRU12OEZnWWtiNzI0d0FGSnlrZER2V0ZpZUZGWFVLbUY3YXNveW5reDNzWUR1UzNjbUpnbmY5UzdNMVRwSzExUUpreGpDUER3QVh1ZHRYNnM0Rk5YTzlraGV6WjhzZVdZWnNXN3JiQmJINjVLSlo0Wnc0clJ4NXV4bno5UUJLT1g2Y1c3cHd6Q1VBNlB1TXBtK3N3T1wvaWY5em5IcjU3QTR2WWt0anNUMWcrTzFkYlU5YU5ZYUFaTWRnRVdcL0t2WGNLdzYxUDRRRXlSMEtoU3FKQVwvcXljbE5jQlFLY2dmZDFYSXQ3XC91cmVyU2FnTFhQUTBzaTVmc0VcL0ZlY1R5TmR2V0tcL0lReDdvcWxKVVRKSVlWVElXalY2THdPWGRtUW1oWWtocFVUYTd3VU5jY0dcL29CN1phVDBkbEtodU1sSGdLcFQrdVFCS1wvYmw5NXpJQmg1OCtNTU84SnVYY3BSWlBcL3RlV1BrYXRwZWFDSVNnWW4rZnoyZ0tcL2h6Z0RtN295VnUrTW5JcmFSelNxVVdjdzhOdWltVWJIMEFTcGxtVDBmMWRpVnFRVHpcLzViXC9ZNDNwc3JzMitncGtjZ0VQVGROUDRpTVQ3ajQ0ZXMrd2tlNElnZGxWREY3U1VQdmpGZUdNdlZUaVhKWjJ3OWtrODBNOTJsWlZGaTRUQTVSSEoxemxvV3V2XC9OTXdyeU1kcWRNMlg1YnQiLCJzdmNFbmNLWSI6IktGUzJXSjNtdjY0ajhEYW1ZU0NrXC9hSnBVMlU5Wm53ajZpejl0N2crU3ROSmlZcjdWUTB6a2RzOXF6QnpWWElqUktGYmN2a1VYeEJlbjZZcGZRNktGXC8xZm43a1ZJWTJ3emJINDdNbG1iN05pcHdadDhzcjNOZk1lbUpPK1wvdEZRZzdkZkZhQThpZFVtckl3angyWFpZVDhabUg1cjRwV205c0RBVWNwa2dXYz0iLCJzdmNFbmNJViI6ImQzZWVkMWE1YzhhNzk2ZGJlZjVlYzFhN2QwNjAzMzc0In0%3D&mode=N

Here's the "bad" URL:

https://account.samsung.com/accounts/ANDROIDSDK/signInGate?locale=en_US&svcParam=eyJjaGtEb051bSI6IjEiLCJzdmNFbmNQYXJhbSI6ImU4OHZuUDZOYUV0WlFZK1k0T2orck80a3g1enpPQW1WWGdLa1wvRmVPOG5qYXdtSytHUkNOdlppbXMrUk5NXC9tb0JrODNmZVwvTVc5NlM5YkVIOExrcHR5bEVsNHBxSXMrbDMxTVVwR00xYTB5WEI3ZGFta1hibWhwVld1ZkFRWlVPSzRQeUo0T2JrOVZiMWZrM2JaMklVUWgxNU9Nb1wveTRHTkxhRzVSYWdUclNSY25WOFRIUlQzeTVTUDhjMUhsOHZLTlIzcFpaV3F3ZHFacTk0VUpQR1pcL2hsOFN5citKSkZ1QXBISm9ZcUJaTmJ0cFRha1VJSWlGWURIdjU0T3YrTk9iRG5KQ1dMRG1MdUZCYXhqaDNWR1ZjRGlqM1VZTTlhQlJoYXZyQmlFYWlPWGVDa00xV25US0djUXpLd3Jmb0VjeXR2XC83TTBiaEFPcDgrSlJMNFArSWxDRUphUTNlcWdjXC9XYnRFNmlSVU9sXC9nbmh0N3JCM2xHWk9rUndjWlZWYk1IQWJ4STJIUjR5VUVxNGJTVnU1QURcLzR3V1lJSmxDWHBHd1c3bDhhbERcL05TV2dsYXZXNzFNNkN6cEtEcmE0eDBBbHBFd3BtMkt4cFlnekM2R2pYNG1xd21QTVwvWU1SdWZqS3Qxb1ZZREdTSUYrZzA2S3VCa1BCSlFUeVhkOFZESVpkNjhsRUg2TVowRVlOYVFlTDhCTnBFK1E0TU5PSEZPWklRS0hQTzdCd2Y4WUFVR2dTZWRUMEVFVHp2cFJqb0xqSCtDWkpmbnUxQVhWWVRFN21JN3JPbFk1NkJ5QklrOE5hbW1EVlpReGZcL1FHazVQREZqbFdkKzdxXC9XTDNpRWpGOVZpY1wvWG5NOEpRSkJtWENkcUZob1FZNzVlblpCOEFCZXJDeWxlSEh1MThPSHR3eTJqS2s4V05sTlpBWXd4RUdPK1wvemFVSGNtWXJWaXNLdDFBdmNFUHhaRWFYWFRBcWRIbjN4UWc2ZEt5TThFZlYwVUZwZkxpZ0NHNm9abkFuNEtcL093WFBYcFhJVkJIeTBWd1NkcU82dHp5V3ppTnFJQWI2akFqZnRybzNCanI5bFVwUVdPeDdtMTFmb3Jpc1pUT2NNVitVd0QxMStiQjk4MDkyUnkyZGdTVG9HdGZVSkNQdEFtREE1VU1UUHZSTWxHbm16RWNmZVIzRWlGckNKUkpKVStncWVZUjRWWml5cVwvTjlFYndYRXpsaVNkc2dRWTd0K2sraVEzKzg4SlwvakdJQlgrRExycExrcXNsYiIsInN2Y0VuY0tZIjoiSWlYTUlBbWJvTndRZzMyXC9Ed09hN1ZJOFRtbDZOVUo1aHptR253Zm1QM05HZ1huaWo4REJGK2tuV0R1Tys5NXBlVFpwTnhZakdXbndTV2lXeERENHBZMGxaYWREK2g4K05YeVB5aHc3WVRIenlLNUVjR1VYMjA5dzVQM0QxNmx2K2hXS0RTOUdJYmtqM2VYR3poUzBXSkVPT0QxWVlQNU9uNVJuNCtwQ2RBQT0iLCJzdmNFbmNJViI6Ijc0YTk0NmE5ZjM4Yzg4MGU1ODQxMGNlZmFmMzMwOTc5In0%3D&mode=N

Not sure where this svcParam comes from or why it'd have a good value when the page gets loaded with the Chrome webview vs. a bad value when the page gets loaded with the Firefox Nightly actual-tab; maybe the Samsung app is somehow able to detect what sort of webview it's going to get?

Comment 9

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Note, the "good" and "bad" URL have the same prefix on the svcParam query-param -- both of those param values start with:

eyJjaGtEb051bSI6IjEiLCJzdmNFbmNQYXJhbSI6I

...but after that, they diverge -- the "good" one has kt5aVFId whereas the "bad" one has "mU4OHZuU" (and they go on with different content from that point on).

Not sure if we can infer anything from that; these are opaque base64 tokens. Just thought it was notable that those first 41 characters were identical. But maybe that's just because it's encoded XML or JSON or somesuch, with the initial part being some constant boilerplate that doesn't vary.

Comment 10

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

(In reply to Daniel Holbert [:dholbert] from comment #6)

importantly: when you've got Firefox Release set as your default browser, the in-app sign-in page there is actually rendered using Chrome, not with Firefox. (You can verify this using the 3-dot-menu that shows up there, and by noticing that the UI is the same that shows up when you have Chrome as your default.)

So this isn't a case of Firefox Nightly/beta being specially broken, but rather them registering specially to handle whatever the in-app-browser-experience is that gets launched by the Samsung apps here, and that in-app-browser-experience being broken when we handle it for whatever reason.

Additional observation on this: if I disable Chrome on my phone (long-press the Chrome app icon, tap "app info" and then "disable"), then Firefox Release (when set as my default browser) does actually seem to start getting legitimately launched as a "custom" in-app tab (a webview-like thing) and it continues to work, while Firefox Beta and Nightly (when set as my default browser) continue to simply spawn new regular tabs which show a browser-not-supported page.

Comment 11

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

(In reply to Daniel Holbert [:dholbert] from comment #8)

maybe the Samsung app is somehow able to detect what sort of webview it's going to get?

Aha, I think that's exactly what's happening -- Samsung's got a library (identified as SA_SDK-1.5.25: [BrowserUtil] in logcat) that seems to be doing some subtle analysis of what browsers are installed. I'll attach some text files to show the difference.

Comment 12

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Attachment: logcat when I get "good" results with Firefox as default browser and Chrome disabled

Comment 13

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Attachment: logcat when Firefox Beta is my default browser (and Chrome is disabled), which gives "bad" results

[edit: deleting mispasted comment text that I mostly moved to an attachment]

Comment 14

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

The relevant difference there seems to be that their BrowserUtil library decides that

createBrowser - isCustomTabNotAvailable ? false

vs....

createBrowser - isCustomTabNotAvailable ? true

And then they end up invoking [CustomTabBrowser] in the "good" case vs. [StandAloneBrowser] in the "bad" case.

So: it looks like this all boils down to some logic in Samsung's internal library for launching web content, where it seems to look for specific browser apps in order, with org.mozilla.firefox being one of the apps that it checks for, whereas beta/nightly are not in the list of apps that it looks for; and I think that difference is responsible for why they get launched as standalone apps with a URL that shows a browser-not-supported page.

Comment 15

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

I can reproduce this same problem if I don't have any Firefox browsers installed, and instead just install Chrome Dev and set that as my default browser, and disable the regular Chrome browser (using the aforementioned "Disable" button that's as-close-as-you-can-get-to-uninstalling for Chrome and other mandatory system apps).

So: this isn't a Firefox issue, but rather it's an issue with Samsung's apps that occurs when they don't find any of the browsers on their SDK's internal list of app identifiers. (And they apparently don't have app identifiers for development browser channels in that list.)

Comment 16

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Attachment: logcat when Chrome Dev is my default browser (and Chrome release is disabled), which gives "bad" results

Comment 17

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Attachment: screencast of this issue happening with Chrome dev

Here's a screencast of this repro'ing with Chrome Dev as my default browser.

I get these same results whether or not the release version of Chrome itself is enabled.

(Interestingly, if I have Firefox installed, then that gets launched instead of Chrome dev, at least in some of my trials -- even though Chrome dev is set as my default browser -- so I captured screencast this with all of my Firefox versions uninstalled.)

Comment 18

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

--> Moving this to webcompat:needs-contact -- we should notify Samsung about this.
--> Also, removing webcompat:needs-sitepatch since I don't think we can sitepatch this, since it seems to be based off of app IDs and interactions-between-Android-apps, rather than just Firefox versions loading a particular website and getting different results.

Comment 19

[Petru-Mugurel Lingurar [:petru]]

Tested this myself and got to the same conclusion as Daniel (nice sleuthing!),
The Samsung apps seem to check whether specific browsers are available and then selectively choose which and how to start.
There is no difference in how Firefox Nightly/Beta and Release are registered to support the custom tab functionality.
-> Seems like an issue with the Samsung apps not using the default browser but their own prioritized list of browsers to open custom tabs.