Skip to content

fix(auth): mitigate tapjacking on the auth activity window#2416

Open
just1and0 wants to merge 1 commit into
masterfrom
fix/2041-tapjacking-filter-touches
Open

fix(auth): mitigate tapjacking on the auth activity window#2416
just1and0 wants to merge 1 commit into
masterfrom
fix/2041-tapjacking-filter-touches

Conversation

@just1and0

Copy link
Copy Markdown
Contributor

Summary

  • Adds window.decorView.filterTouchesWhenObscured = true in FirebaseAuthActivity.onCreate() to mitigate tapjacking/clickjacking attacks where an overlay intercepts user touches on the auth UI.
  • FirebaseAuthActivity is the only activity in the auth module (v10 is Compose-based), so this single-line change covers the entire auth flow.

Fixes #2041

Test plan

  • Launch the auth flow and verify touch input works normally without overlays
  • Verify that touches are ignored when another app draws an overlay on top of the auth UI

Fixes #2041 by ignoring touches when the auth UI window is obscured by
another overlay, as recommended for overlay-based clickjacking attacks.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates FirebaseAuthActivity by setting window.decorView.filterTouchesWhenObscured to true in onCreate. This is a security improvement to prevent tapjacking by filtering touch events when the window is obscured. There are no review comments, and I have no feedback to provide.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security issue with tapjacking

1 participant