Skip to content

fix(auth): mitigate tapjacking on the auth activity window #2416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
just1and0 wants to merge 2 commits into
base: version-10.0.0-beta04
Choose a base branch
from
Open

fix(auth): mitigate tapjacking on the auth activity window #2416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3ac23f
fix(auth): mitigate tapjacking on the auth activity window
just1and0 Jun 4, 2026
850d011
fix(auth): extend tapjacking protection to Compose dialog windows
just1and0 Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ class FirebaseAuthActivity : ComponentActivity() {

override fun onCreate(savedInstanceState: Bundle?) {
super.onCreate(savedInstanceState)
window.decorView.filterTouchesWhenObscured = true

@russellwheatley russellwheatley Jul 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This covers the activity's own window, but the Compose Dialogs in this module (e.g. ReauthenticationDialog for password re-entry) create their own separate native Window that this flag doesn't propagate to. Could you also set filterTouchesWhenObscured on those dialog windows, or note in the description that they're out of scope for this fix?

@just1and0 just1and0 Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 850d011 — added filterTouchesWhenObscured to both ReauthenticationDialog and ErrorRecoveryDialog via a SideEffect that sets the flag on the dialog's root view.

@russellwheatley russellwheatley Jul 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FirebaseAuthActivityTest.kt already has a Robolectric harness for this activity. Worth adding a small test asserting filterTouchesWhenObscured is true after onCreate so this can't silently regress.

@just1and0 just1and0 Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added in 850d011 — new Robolectric test asserting filterTouchesWhenObscured is true on the activity window after onCreate.

enableEdgeToEdge()

// Extract configuration and auth instance from cache using UUID key
Expand Down
4 changes: 4 additions & 0 deletions auth/src/main/java/com/firebase/ui/auth/ui/components/ErrorRecoveryDialog.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,9 @@ import androidx.compose.material3.MaterialTheme
import androidx.compose.material3.Text
import androidx.compose.material3.TextButton
import androidx.compose.runtime.Composable
import androidx.compose.runtime.SideEffect
import androidx.compose.ui.Modifier
import androidx.compose.ui.platform.LocalView
import androidx.compose.ui.text.style.TextAlign
import androidx.compose.ui.window.DialogProperties
import com.firebase.ui.auth.AuthException
Expand Down Expand Up @@ -80,6 +82,8 @@ fun ErrorRecoveryDialog(
AlertDialog(
onDismissRequest = onDismiss,
title = {
val view = LocalView.current
SideEffect { view.rootView.filterTouchesWhenObscured = true }
Text(
text = stringProvider.errorDialogTitle,
style = MaterialTheme.typography.headlineSmall
Expand Down
4 changes: 4 additions & 0 deletions auth/src/main/java/com/firebase/ui/auth/ui/components/ReauthenticationDialog.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ import androidx.compose.material3.Text
import androidx.compose.material3.TextButton
import androidx.compose.runtime.Composable
import androidx.compose.runtime.LaunchedEffect
import androidx.compose.runtime.SideEffect
import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.remember
Expand All @@ -39,6 +40,7 @@ import androidx.compose.ui.Modifier
import androidx.compose.ui.focus.FocusRequester
import androidx.compose.ui.focus.focusRequester
import androidx.compose.ui.platform.LocalContext
import androidx.compose.ui.platform.LocalView
import androidx.compose.ui.text.input.ImeAction
import androidx.compose.ui.text.input.KeyboardType
import androidx.compose.ui.text.input.PasswordVisualTransformation
Expand Down Expand Up @@ -75,6 +77,8 @@ fun ReauthenticationDialog(
AlertDialog(
onDismissRequest = { if (!isLoading) onDismiss() },
title = {
val view = LocalView.current
SideEffect { view.rootView.filterTouchesWhenObscured = true }
Text(
text = stringProvider.reauthDialogTitle,
style = MaterialTheme.typography.headlineSmall
Expand Down
10 changes: 10 additions & 0 deletions auth/src/test/java/com/firebase/ui/auth/FirebaseAuthActivityTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,16 @@ class FirebaseAuthActivityTest {
assertThat(shadowActivity.resultCode).isEqualTo(Activity.RESULT_CANCELED)
}

@Test
fun `activity sets filterTouchesWhenObscured on window after onCreate`() {
val intent = FirebaseAuthActivity.createIntent(applicationContext, configuration)
val controller = Robolectric.buildActivity(FirebaseAuthActivity::class.java, intent)

val activity = controller.create().get()

assertThat(activity.window.decorView.filterTouchesWhenObscured).isTrue()
}

// =============================================================================================
// Configuration Extraction Tests
// =============================================================================================
Expand Down