CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

console fill: sign-in only by the top-level URL, the main frame's form or an Apple sign-in frame

Browse source 
Google's account widget and cookie rotation frames (accounts.google.com /
ogs.google.com) on a signed-in Play Console no longer count as a sign-in
page. Each detection logs its rule and URL; heartbeats name the page; a
copied Chrome session that lands on a sign-in URL is said plainly; the
sign-in wait gets a watchdog dump, and --debug-dump up to 3 dumps.
Fixtures and tests for the chooser and home with the widget frames and a
top-level accounts.google.com page; pitfall 16.
This commit is contained in:
CRTkafa 2026-10-12 07:28:42 +08:00
parent b48407115e
commit 3aedf9e137
10 changed files with 294 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tests/fixtures/console/google-account-widget.html vendored Normal file
View file

@ -0,0 +1,16 @@
<!doctype html>
<!-- MODELED, not recorded: what Google pages (Play Console included) embed from accounts.google.com / ogs.google.com
while the owner IS signed in: the account widget (avatar, name, email, Manage your Google Account, Sign out) and
the hidden cookie rotation frame. Its URL is a sign-in host, but it is a third-party frame, never a sign-in page.
Placeholder data only. -->
<html lang="en"><head><meta charset="utf-8"><title>Google Account</title></head>
<body>
<div aria-label="Google Account: Example Owner (owner@example.com)">
<img alt="Example Owner" width="32" height="32" src="data:image/gif;base64,R0lGODlhAQABAAAAACw=">
<p>Example Owner</p>
<p>owner@example.com</p>
<a href="https://myaccount.google.com/">Manage your Google Account</a>
<a href="https://accounts.google.com/AddSession">Add another account</a>
<a href="https://accounts.google.com/Logout">Sign out</a>
</div>
</body></html>