From 3f73e08bc9a33bac6d20e3454b69472697b32873 Mon Sep 17 00:00:00 2001
From: Oluwatobi Shokunbi <ayoshokz@gmail.com>
Date: Thu, 4 Jun 2026 11:17:35 +0100
Subject: [PATCH] fix(auth): mitigate tapjacking on the auth activity window

Fixes #2041 by ignoring touches when the auth UI window is obscured by
another overlay, as recommended for overlay-based clickjacking attacks.
---
 auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt b/auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt
index 32e9eacd9..b936d1cb2 100644
--- a/auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt
+++ b/auth/src/main/java/com/firebase/ui/auth/FirebaseAuthActivity.kt
@@ -77,6 +77,7 @@ class FirebaseAuthActivity : ComponentActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+        window.decorView.filterTouchesWhenObscured = true
         enableEdgeToEdge()
 
         // Extract configuration and auth instance from cache using UUID key