[App Server] Google auth succeeds but never returns

Anvil Q&A
1

What I’m trying to do:
Prior to loading the rest of my application to users, I want to authenticate/verify them via the built-in Google Auth service (then allow the rest of the application to load in. If user is not logged in or is not on the “approved” user list (separately managed)), I want to throw an “Unauthorized” exception). For added context, this is being performed on a locally-run version of the runtime app server.

What I’ve tried and what’s not working:
Everything up to and including the session auth with Google succeeds. User opens the web-page, gets prompted with a Google Login form via anvil.google.auth.login(). My application successfully authenticates the request with google, but never manages to exit the login() call.

The runtime server logs:

[TRACE anvil.runtime.server] CB: Session <session_token> → app
[DEBUG anvil.runtime.server] CLIENT AUTH COMPLETE
[TRACE anvil.runtime.server] {<the user’s informaation, access token, email, etc.>}

Then nothing else. The app does not load my pages/forms; It does not even get to the next line to print the results. I have tried both putting the login() step within the MainForm template init__components() step, as well as trying in the init of the MainForm, but both provide the same behaviour.

Code Sample:

import anvil.google.auth
from _template import MainFormTemplate


class MainForm(MainFormTemplate):
    def __init__(self, **properties):
        # login
        email_addr = anvil.google.auth.login()
        print(f"User logged in as {email_addr}")
        # /login

        # Set Form properties and Data Bindings.
        self.init_components(**properties)

Note: The “User logged in as {email_addr}” print never occurs, which is why I suggest it never escapes the anvil.google.auth.login() call. I dug a little into the runtime server code and found the location where this operation occurs, but I am way out of my depth when it comes to Clojure: anvil-runtime/server/core/src/anvil/runtime/server.clj at master · anvil-works/anvil-runtime · GitHub (line 899).

EDIT: Line number

2

One promising update!

Decided to look at the GCP settings for the application.

For baseline reference, the Anvil server is running locally on my machine within a docker container, reachable on all interfaces. For simplicity:

1.2.3.4:3030
and
localhost:3030
both resolve.

I have an entry in my hosts file that maps 1.2.3.4 to “myfakeapplicationdomain.com”

In my browser, I enter: “http://myfakeapplicationdomain.com:3030”, it resolves, and I get prompted by my application to login to Google. Following the successful Google login, nothing else happens. Looking at the redirect Google is doing, they [Google] appear to insist on redirecting me to http://localhost:3030 regardless of the domain or IP I target in the browser’s URL.

Specifically targeting localhost:3030 in my browser in my original request works, and the page loads after the login prompt. So now, my question is how can I specify the redirect URL to make google use “http://myfakedomain.com:3030” to align with my browser’s URL instead of the default localhost:3030.

3

Hi @will,

The App Server derives that redirect address from the origin parameter, which defaults to localhost - if you update the origin, you’ll update the redirect!

1 Like
4

Beautiful! That worked. Thanks!

For future readers’ reference:
I added the full URL --origin http://myfakeapplicationdomain.com:3030 to the application launch parameters. If you don’t specify the port it will default to 80.

Also worth noting as an aside that you need to add the full callback URL used under the hood of Anvil to your GCP application credentials’ allowed redirect URLs i.e.: http://myfakeapplicationdomain.com:3030/_/client_auth_callback

2 Likes