title: Google Sign-In button - What prevents someone from spoofing another app and stealing a token?
body: <p>Using this page: <a href="https://developers.google.com/identity/sign-in/web/sign-in" rel="nofollow noreferrer">https://developers.google.com/identity/sign-in/web/sign-in</a></p>
  
  <p>It's really easy to add a button to a page for a <strong>client side only</strong> login with Google.  </p>
  
  <p>On Clicking the button, the user is presented with a screen like this:</p>
  
  <p><a href="https://i.stack.imgur.com/vJllH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vJllH.png" alt="google auth popup"></a></p>
  
  <p>There are 2 ux_mode for this button: "popup" and "redirect":
  <a href="https://developers.google.com/identity/sign-in/web/reference" rel="nofollow noreferrer">https://developers.google.com/identity/sign-in/web/reference</a></p>
  
  <p>My question is about ux_mode=popup specifically, where the originating page doesn't change, and all the login flow is handled in a separate popup window.</p>
  
  <p>Imagine a good app is published. It seems like an attacker could clone the app, present it to a user. The user thinking it's good app would login and the attacker would have a way to grab a valid token from the user for good app.</p>
  
  <p>Now I understand that in that mode (popup), the IDP (Google) will reject anything that doesn't come from an Origin that is not part of the explicit list of redirect URIs set in the configuration of the project.</p>
  
  <p>But is that the only thing that prevents this? I have read again and again that one should not rely on CORS for the security. Also I'm not sure but it seems that it can be circumvented with a little bit of crafting.</p>
  
  <p>Is there another aspect of the security of this login flow I am missing?</p>