Google Classroom Add-Ons fail to pass sign-in with 3P cookies blocked [273552829]

Bug

Status Update

No update yet.

Description

wp...@google.com

created issue #1

Mar 14, 2023 06:53PM

Thank you for taking the time to report a broken web experience related to the blocking of third party cookies. Please follow the instructions below to report your issue.

The Chrome Privacy Sandbox team

Instructions: Please ensure that this submission is for one specific issue. If you have multiple breakage issues to report, please file them separately to allow for ease of triage by our team.

classroom.google.com
3P add-ons are integrated into Classroom by opening an iframe to the 3P web app. Users need to sign in to their Google account on the web app, but this fails with 3P cookies blocked. More examples can be found at this audit doc or this story doc
- To reproduce, contact hr-ext-eng@. You will need an account with add-ons enabled to test this (premium feature for Classroom).
For screenshots, see the audit doc
(Optional) Is the affected site used mostly in a managed enterprise setup (i.e. on corporate devices)?
- No
(Optional) any other pertinent info that may be required. If you are aware of the underlying technical issues, please share as much as you can here.

Comments

jo...@google.com <jo...@google.com> Apr 19, 2023 09:51AM

Reassigned to jo...@google.com.

jo...@google.com <jo...@google.com> #2May 16, 2023 11:55AM

Status: New

I discussed this with the Classroom team and they're messaging to affected developers and will track progress internally for now.

It's likely that many of the add-ons are affected, mostly with identity/GSI use cases.

Let's keep this bug as a general tracker for Classroom add-ons and follow up in a few weeks to check in on the progress.

ds...@google.com <ds...@google.com> #3Aug 18, 2023 02:33PM

Just following up here with a recap. We synced with the Privacy Sandbox team and determined that the existing Privacy Sandbox API's aren't currently able to resolve this breakage, at least before the 1% 3P cookie deprecation. For now, we will continue to collaborate to find a solution.

I have summarized the state of Classroom add-ons impact in go/cookieless-classroom-add-ons-summary and the investigation into Privacy Sandbox API's in go/cookieless-classroom-add-ons.

ds...@google.com <ds...@google.com> #4Nov 15, 2023 07:47PM

Following up here that we recommended the Storage Access API to developers as a solution to this issue. While not an ideal UX for students, it does restore critical user journeys.

ds...@google.com <ds...@google.com> #5Dec 12, 2023 07:49PM

Just updating this for clarity of deprecation trial reviewers.

The technical issue and background is described in go/cookieless-classroom-add-ons.
An example failure case is documented in go/classroom-add-on-3pc-failure-example for CK12, but all add-ons will be the same, as they have the same sign-in requirements.
The normal flow for add-ons is shown in go/add-on-sso-flow for additional context

Issue 273552829