[google_sign_in_web] signing in with google looks incompatible with WASM

Steps to reproduce

clone this repo
run the trivial example via flutter run -d chrome --web-port 42069
sign in with google using the button / pop up flow
everything works as intended
close the application, and then re-run it...
... but this time, use flutter run -d chrome --web-port 42069 --wasm
try the sign in with google flow
the flow unexpectedly stops on the pop-up, which stays blank

Expected results

"Sign In with Google" to work with WASM effortlessly.

Actual results

the flow breaks or, rather, it stops entirely.

Code sample

Again, use this repo, which also contains web-platform related configurations, as mentioned in the docs.

Screenshots or Video

Screenshot

Logs

by using --wasm I'm not able to see any logs in the debug console, nor the debugger is actually there; so, debugging is quite painful (when possible).

luckily, the web console prints the following in the pop-up window:

Logs

m=transform_layer_library:228 Uncaught TypeError: Cannot read properties of null (reading 'postMessage')
lm @ m=transform_layer_library:228
mm @ m=transform_layer_library:228
_.rm.h @ m=transform_layer_library:230
Kq.h @ m=transform_layer_library:238
(anonymous) @ m=transform_layer_library:240
(anonymous) @ transform:1

no other errors are mentioned there, or in the main window.

Flutter Doctor output

Doctor output

> flutter doctor
Doctor summary (to see all details, run flutter doctor -v):
[✓] Flutter (Channel stable, 3.38.1, on macOS 15.6.1 24G90 darwin-arm64, locale en-IT)
[✓] Android toolchain - develop for Android devices (Android SDK version 36.0.0-rc1)
[!] Xcode - develop for iOS and macOS (Xcode 26.2)
    ✗ CocoaPods installed but not working.
        You appear to have CocoaPods installed but it is not working.
        This can happen if the version of Ruby that CocoaPods was installed with is different from the one being used to invoke it.
        This can usually be fixed by re-installing CocoaPods.
      For re-installation instructions, see https://guides.cocoapods.org/using/getting-started.html#installation
[✓] Chrome - develop for the web
[✓] Connected device (2 available)
    ! Error: Failed to prepare the device for development. Please unlock and reconnect the device. (code 806)
    ! Error: Browsing on the local area network for BEMDAPIS680. Ensure the device is unlocked and attached with a cable or associated with the same local area network as this Mac.
      The device must be opted into Developer Mode to connect wirelessly. (code -27)
[✓] Network resources

! Doctor found issues in 1 category.

Notes

I would love to understand if:

I did not understand the plugin configuration instructions
We should walk an extra mile when it comes to WASM, but then it should be documented
If there's any inner blocker about this issue and - if there is - how can I work around that

Duplicate of firebase/flutterfire#12819

#180026 fixes that you just need to pass --no-cross-origin-isolation in development mode (note: the fix hasn't landed on stable yet, so use master). This way the WASM will run in single threaded mode.

If you want to use stable flutter then use #163479 (comment) workaround

@maRci002

Thanks @maRci002
@lucavenir Please check above and see if it helps to resolve your case or not.

@maRci002

@maRci002 thank you for the quick reply.

I can see there's a firebase related issue, so thank you; but this is about google_sign_in (we're not using firebase ourselves). Is there any difference?

you just need to pass --no-cross-origin-isolation in development mode

To be clear (on stable), I receive this Uncaught TypeError: Cannot read properties of null even with --release. Why did you specify about development mode?

switch to master

Yes, this works, both on debug and release modes. But I see this error message in the console:

Cross-Origin-Opener-Policy policy would block the window.postMessage call.

is this intentional? Is there any side effect to it? Anyways, I still have doubts about this flag (see below).

#163479 (comment)

This doesn't seem to work for me. I'm unable to make this workaround work on stable.

This way the WASM will run in single threaded mode.

Is it possible to have documentation about this topic? Why would we need single threaded mode when signing in with google? I realize I'm ignorant, but I can't possibly be the only one stumbling on this without surprises.

Most importantly: are there any side effects to this? Are we giving up multi threading on WASM just to make Google Auth work? Did I get this right?

Again, I'm sorry if I'm asking dumb questions, but I re-read the linked threads and I can't honestly make much out of it.

Keeping issue open and labeling for team's tracking.

I can see there's a firebase related issue, so thank you; but this is about google_sign_in (we're not using firebase ourselves). Is there any difference?

Sorry about the confusion. I believe these issues are related, since both Firebase Auth and google_sign_in use a popup-based authentication flow. When a crossOriginIsolated environment is enabled, the popup window can no longer communicate with your Flutter app via window.postMessage, which causes this failure.

#163479 (comment)

This doesn't seem to work for me. I'm unable to make this workaround work on stable.

Make sure to comment out the COOP / COEP headers and then regenerate flutter_tools.snapshot.

Is it possible to have documentation about this topic? Why would we need single threaded mode when signing in with google? I realize I'm ignorant, but I can't possibly be the only one stumbling on this without surprises.

Most importantly: are there any side effects to this? Are we giving up multi threading on WASM just to make Google Auth work? Did I get this right?

You can read more about this issue here:
firebase/firebase-js-sdk#6199
firebase/firebase-js-sdk#6467

Unfortunately, Google has full control over this behavior. Their authentication flow has not been updated to properly support COOP / COEP headers. As a result, you must run in a non-crossOriginIsolated environment, which means SharedArrayBuffer is unavailable. Because of that, WebAssembly cannot use multithreading, since threads rely on SharedArrayBuffer for communication.

One thing I'm interested in, and I can't seem to find documented anywhere: what is the impact of running flutter (wasm) in single-threaded mode (vs multi-threaded mode)?

Which parts of the framework are heavy enough, CPU-wise, to warrant sending the processing to a background thread?
Are there any examples/measurements of performance improvements?

This info would be helpful, especially considering that the GIS popup window will not be changing behavior in the near (or medium) future.

One thing I'm interested in, and I can't seem to find documented anywhere: what is the impact of running flutter (wasm) in single-threaded mode (vs multi-threaded mode)?

Main Thread Contention: In multi-threaded mode, Flutter uses a Web Worker and OffscreenCanvas to handle rasterization. In single-threaded mode, all rendering logic is moved to the main thread. This means rendering must compete for CPU time with your application logic and the browser's UI tasks, increasing the likelihood of "jank" if the main thread is busy.
Browser Compatibility: This mode acts as a fallback for browsers that don't support OffscreenCanvas with WebGL (notably Safari) or for environments that aren't crossOriginIsolated (where SharedArrayBuffer is disabled).
Execution Model: Instead of posting messages to a worker, the engine schedules microtasks on the main thread. While functionally identical, you lose the performance benefit of parallelizing the UI and Raster workloads.

Deduplicating into firebase/flutterfire#12819. This is a COOP/COEP issue.

@maRci002

Make sure to comment out the COOP / COEP headers and then regenerate flutter_tools.snapshot

Since the other issues is now closed and locked, I reply in here @maRci002. This is not working. Here's what I'm doing, step by step:

First, I find out about my flutter installation path:

% which flutter
[...] mise/installs/flutter/3.38.6-stable/bin/flutter

Then, I cat [...]/web/web_constants.dart

web constants before editing

// Copyright 2014 The Flutter Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

const kWasmMoreInfo = 'See https://flutter.dev/to/wasm for more information.';

/// Headers required to run Wasm-compiled applications with multi-threading.
///
/// See https://developer.chrome.com/blog/coep-credentialless-origin-trial
/// for more information.
const kMultiThreadedHeaders = <String, String>{
  'Cross-Origin-Opener-Policy': 'same-origin',
  'Cross-Origin-Embedder-Policy': 'credentialless',
};

Then, I edit the file (e.g. nano [...]/web/web_constants.dart) as shown.

Then, I cat [...]/web/web_constants.dart again to check out the edits.

web constants after my edits

// Copyright 2014 The Flutter Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

const kWasmMoreInfo = 'See https://flutter.dev/to/wasm for more information.';

/// Headers required to run Wasm-compiled applications with multi-threading.
///
/// See https://developer.chrome.com/blog/coep-credentialless-origin-trial
/// for more information.
const kMultiThreadedHeaders = <String, String>{
  // 'Cross-Origin-Opener-Policy': 'same-origin',
  // 'Cross-Origin-Embedder-Policy': 'credentialless',
};

I proceed to remove the cached snapshot: rm [...]/mise/installs/flutter/3.38.6-stable/bin/cache/flutter_tools.snapshot

Then, flutter doctor.

flutter doctor after the edits

% flutter doctor
Building flutter tool...
Resolving dependencies... 
Downloading packages... 
Got dependencies.
Doctor summary (to see all details, run flutter doctor -v):
[✓] Flutter (Channel stable, 3.38.6, on macOS 26.2 25C56 darwin-arm64, locale en-IT)
[✓] Android toolchain - develop for Android devices (Android SDK version 36.0.0-rc1)
[✓] Xcode - develop for iOS and macOS (Xcode 26.2)
[✓] Chrome - develop for the web
[✓] Connected device (2 available)
[✓] Network resources

• No issues found!

Almost there; I open a new terminal session and spin up chromedriver

chome driver output

% chromedriver --port=4444
Starting ChromeDriver 143.0.7499.192 (be2c1f4fd451578a9ada68a0ac12d659362b44bf-refs/branch-heads/7499@{#4083}) on port 4444
Only local connections are allowed.
Please see https://chromedriver.chromium.org/security-considerations for suggestions on keeping ChromeDriver safe.
ChromeDriver was started successfully on port 4444.

Finally, I spin up the test via

% flutter drive \
  --driver=test_driver/integration_test.dart \
  --target=integration_test/my_test.dart \
  -d chrome

... But the logs indicates crossOriginIsolated is false, and indeed the memory usage turns out to be null

flutter driver output

% flutter drive \
  --driver=test_driver/integration_test.dart \
  --target=integration_test/my_test.dart \
  -d chrome

Resolving dependencies... 
Downloading packages... 
  characters 1.4.0 (1.4.1 available)
  google_sign_in_ios 6.2.4 (6.2.5 available)
  matcher 0.12.17 (0.12.18 available)
  material_color_utilities 0.11.1 (0.13.0 available)
  meta 1.17.0 (1.18.0 available)
  test_api 0.7.7 (0.7.9 available)
Got dependencies!
6 packages have newer versions incompatible with dependency constraints.
Try `flutter pub outdated` for more information.
Launching integration_test/my_test.dart on Chrome in debug mode...
Waiting for connection from debug service on Chrome...              6.3s
This app is linked to the debug service: ws://127.0.0.1:56399/eJfsMIwwD2U=/ws
Debug service listening on ws://127.0.0.1:56399/eJfsMIwwD2U=/ws
A Dart VM Service on Chrome is available at: http://127.0.0.1:56399/eJfsMIwwD2U=
The Flutter DevTools debugger and profiler on Chrome is available at: http://127.0.0.1:56399/eJfsMIwwD2U=/devtools/?uri=ws://127.0.0.1:56399/eJfsMIwwD2U=/ws
Starting application from main method in: org-dartlang-app:/web_entrypoint.dart.
00:00 +0: testing testing one two testing
isSecureContext: true, crossOriginIsolated: false
memory usage: null bytes
00:03 +1: (tearDownAll)
00:03 +2: All tests passed!

The code is available here.

But the logs indicates crossOriginIsolated is false

It seems the patch is working as intended, since the COOP/COEP headers are no longer applied therefore crossOriginIsolated should be false and authentication should work. What does your console say—are there any errors?

Remember, after applying the patch you can enable the COOP/COEP headers again at any time:

--web-header=Cross-Origin-Opener-Policy=same-origin 
--web-header=Cross-Origin-Embedder-Policy=credentialless

Building flutter tool...

This also means the snapshot is being rebuilt.

I’m not sure whether Flutter Driver uses the same ReleaseAssetServer as a running Flutter application.

remember, after applying the patch you can enable the COOP/COEP headers again at any time

Thank you ❤️ This is what I needed.

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

Navigation Menu

Repository navigation

[google_sign_in_web] signing in with google looks incompatible with WASM #180690

Steps to reproduce

Expected results

Actual results

Code sample

Screenshots or Video

Logs

Flutter Doctor output

Notes

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[google_sign_in_web] signing in with google looks incompatible with WASM #180690

Description

Steps to reproduce

Expected results

Actual results

Code sample

Screenshots or Video

Logs

Flutter Doctor output

Notes

Activity

maRci002 commented on Jan 9, 2026

darshankawar commented on Jan 9, 2026

lucavenir commented on Jan 11, 2026

darshankawar commented on Jan 12, 2026

maRci002 commented on Jan 12, 2026

wreppun commented on Jan 13, 2026

maRci002 commented on Jan 14, 2026

yjbanov commented on Jan 14, 2026

lucavenir commented on Jan 16, 2026

maRci002 commented on Jan 16, 2026

lucavenir commented on Jan 19, 2026

github-actions commented on Feb 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions