OAuth now impossible

Support Feature Requests
, ,
1

Describe your feature request
Allow project.user.repl.co domains function like replit.dev domains, still only staying online when a project is running. It’s terrible that they uselessly redirect to the project page instead of linking to the project preview (if online). >:(

What problem(s) would this feature solve?
Make it so people can test OAuth apps, as it’s almost impossible to do anymore. Fix issues with Authorised JavaScript origins and Authorised redirect URIs.

Explain what you were trying to do when you came across the problem leading to this feature request
Test an app with Google Drive integration, which is now impossible unlike how it used to be before making repl.co domains useless. This inconsiderate repl.co change ends up screwing over a lot of developers testing out OAuth.

2 Likes
2

How is OAuth impossible? Just put the replit.dev domain instead of repl.co.

3 Likes
3

The thing is - you can’t. Google requires you to verify the lowest level domain possible in search console, which would be replit.dev. That’s not possible because we don’t have access to the DNS/hosting of replit.dev.

repl.co is on the PSL which is why it was possible to use repl.co domains for OAuth as we were only required to verify <user>.repl.co rather than repl.co

I guess the real question should be whether replit.dev can be added to the PSL

3 Likes
4

Also, even though this might be unexpected behavior, I’ve personally found replit.dev links to be more ephemeral than a once-a-year type of thing; and they sometimes use repl.co instead of replit.dev!

3 Likes
5

I have never seen repl.co links be useful since the change happened… very interesting that you got it to even work sometimes.

I wish they’d fix repl.co behaviour so we can not deal with such a broken workflow now.

2 Likes
6

Why would you need to use Search Console for OAuth???

2 Likes
7

They were specifically talking about Google OAuth. Pretty much every google product that requires some form of domain verification uses search console

3 Likes
8

hmm ok, but then why do you need domain verif?

2 Likes
9

Because that’s how Google OAuth consent screens work. You need to verify the domains you use for any url on the consent screen (redirect, allowed origins, privacy policy, etc)

4 Likes
10

BTW, this isn’t just a Google OAuth issue, but also affects most or all of these services, such as Discord OAuth, and Yandex OAuth.

3 Likes
11

*.replit.dev and *.replit.app is on the PSL now! :slight_smile: So whenever all these organizations pull the latest PSL from upstream they should start allowing you to use .replit.dev and .replit.app as valid TLDs.

6 Likes