SAML stopped working recently

[sreboot]

SAML stopped working for some reason since around 1st of October. After login succeeds the Webkitgtk window just hangs in some loop and never returns a successfully logged in message.

At first suspected a recent Webkitgtk update, but also tested with an older version, same result. Also removed cookies and cache multiple times.

So far tested on both OpenBSD and Debian 12, hangs the same way. If the --external flag is used I can login fine in Firefox and the pre-auth cookie is visible in dev tools.

Collected some output with verbose log (last few lines):

[REQUEST] POST for resource https://play.google.com/log?format=json&hasfast=true&authuser=0
[RECEIVE] 131 bytes of text/plain; charset=UTF-8 for resource POST https://play.google.com/log?format=json&hasfast=true&authuser=0
[REQUEST] POST for resource https://play.google.com/log?hasfast=true&authuser=0&format=json
[RECEIVE] 131 bytes of text/plain; charset=UTF-8 for resource POST https://play.google.com/log?hasfast=true&authuser=0&format=json
[REQUEST] POST for resource https://play.google.com/log?format=json&hasfast=true&authuser=0
[RECEIVE] 131 bytes of text/plain; charset=UTF-8 for resource POST https://play.google.com/log?format=json&hasfast=true&authuser=0
[REQUEST] POST for resource https://play.google.com/log?format=json&hasfast=true&authuser=0
[RECEIVE] 131 bytes of text/plain; charset=UTF-8 for resource POST https://play.google.com/log?format=json&hasfast=true&authuser=0
[REQUEST] POST for resource https://play.google.com/log?format=json&hasfast=true&authuser=0
[RECEIVE] 131 bytes of text/plain; charset=UTF-8 for resource POST https://play.google.com/log?format=json&hasfast=true&authuser=0
[REQUEST] POST for resource https://accounts.google.com/v3/signin/_/AccountsSignInUi/browserinfo?f.sid=-<REDACTED>&bl=boq_identityfrontendauthuiserver_20241006.08_p0&hl=en-US&TL=<REDACTED>&_reqid=549891&rt=j
[RECEIVE] 0 bytes of application/json; charset=utf-8 for resource POST https://accounts.google.com/v3/signin/_/AccountsSignInUi/browserinfo?f.sid=-<REDACTED>&bl=boq_identityfrontendauthuiserver_20241006.08_p0&hl=en-US&TL=<REDACTED>&_reqid=549891&rt=j

Perhaps Google is blocking some of the SAML requests from non standard browsers?

As a side note https://github.com/yuezk/GlobalProtect-openconnect works as it completes the SAML part in the default browser.