Google blocked my own browser from logging into my own Gmail, and the reason was not what I expected
A week ago Gmail just stopped letting me in. Every time, same message: "This browser or app may not be secure." No password box, nothing. Just stuck there.
My first guess was the usual thing with browsers built on Electron, so I changed the user agent to look like normal desktop Chrome. That made it worse, not better. Changing it pushed the login into Google's stricter sign in flow, which runs a check called Botguard. That check looks for native Chrome components a normal embedded browser does not have, so it saw mine was missing them and blocked it right away.
Here is the part that actually confused me. I put the user agent back to normal and it still did not work. Turned out once Google rejects you like that once, it writes two cookies into your session as a kind of mark. After that, every attempt gets checked against those cookies first and gets sent straight back to the same rejection page, before even trying to log in again.
So the real fix needed three things. Quietly switch the login to Google's lighter sign in flow instead of fighting the strict one. Leave the browser looking completely normal on Google's own pages, no changes at all there. And automatically clear those marker cookies if a rejection ever happens again, so it cannot get stuck rejecting itself.
Wrote up the full version with the actual code here if anyone wants it: Google Auth Botguard
This came up while working on Mise, a personal privacy focused browser I use daily. Curious if anyone else building something similar has run into Botguard like this.