Flutter InAppWebView：Google登录跳转空白页问题排查

1. 完善第三方登录窗口的导航监听 #

Google、Apple这类第三方授权会在独立窗口完成流程，你当前的onCreateWindow可能只创建了窗口但没处理授权后的回调跳转。需要在新窗口中监听加载完成事件，捕获带firebaseToken的回调地址：

InAppWebView(
  onCreateWindow: (controller, createWindowRequest) async {
    return await showDialog(
      context: context,
      builder: (context) => AlertDialog(
        content: SizedBox(
          width: MediaQuery.of(context).size.width,
          height: MediaQuery.of(context).size.height * 0.8,
          child: InAppWebView(
            initialUrlRequest: URLRequest(url: createWindowRequest.request.url),
            onLoadStop: (dialogController, url) async {
              final urlStr = url.toString();
              // 检测是否是带token的回调地址
              if (urlStr.contains('lirmusic.com') && urlStr.contains('firebaseToken')) {
                // 提取token并完成Firebase登录
                final token = Uri.parse(urlStr).queryParameters['firebaseToken'];
                if (token != null) {
                  await FirebaseAuth.instance.signInWithCustomToken(token);
                }
                // 关闭弹窗并刷新原WebView
                Navigator.pop(context);
                controller.loadUrl(urlRequest: URLRequest(url: Uri.parse('https://lirmusic.com')));
              }
            },
            settings: const InAppWebViewSettings(
              supportMultipleWindows: true,
              javaScriptCanOpenWindowsAutomatically: true,
              javaScriptEnabled: true,
            ),
          ),
        ),
      ),
    );
  },
  // 原WebView的基础配置
  initialUrlRequest: const URLRequest(url: Uri.parse('https://lirmusic.com/mobileLogin')),
  settings: const InAppWebViewSettings(
    supportMultipleWindows: true,
    javaScriptCanOpenWindowsAutomatically: true,
    domStorageEnabled: true,
  ),
)

2. iOS平台的专属配置 #

iOS对WebView的跨域和弹窗有严格限制，需修改Info.plist：

• 添加ATS例外，允许第三方登录域名的网络请求：

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>google.com</key>
    <dict>
      <key>NSIncludesSubdomains</key>
      <true/>
      <key>NSAllowsArbitraryLoads</key>
      <true/>
    </dict>
    <key>facebook.com</key>
    <dict>
      <key>NSIncludesSubdomains</key>
      <true/>
      <key>NSAllowsArbitraryLoads</key>
      <true/>
    </dict>
    <key>lirmusic.com</key>
    <dict>
      <key>NSIncludesSubdomains</key>
      <true/>
      <key>NSAllowsArbitraryLoads</key>
      <true/>
    </dict>
  </dict>
</dict>

• 添加跳转白名单，允许第三方应用回调：

<key>LSApplicationQueriesSchemes</key>
<array>
  <string>googlechrome</string>
  <string>fb</string>
  <string>appleidauth</string>
</array>

3. 排查ThirdWeb的登录回调逻辑 #

由于网站基于ThirdWeb，需确认：

• 第三方授权成功后，是否直接跳转至带firebaseToken的lirmusic.com地址，而非通过无触发WebView事件的JS跳转
• 若使用JS跳转，可通过onConsoleMessage监听前端日志，或在原WebView的onNavigationDelegate中拦截所有导航请求，确保token被捕获

4. Android平台的权限与配置检查 #

• 确保AndroidManifest.xml添加了网络权限：

<uses-permission android:name="android.permission.INTERNET" />

• 确保WebView启用了DOM存储（第三方登录依赖会话存储）：

settings: const InAppWebViewSettings(
  domStorageEnabled: true,
  javaScriptEnabled: true,
  supportMultipleWindows: true,
)

内容的提问来源于stack exchange，提问作者Birto