Can't sign in to Google in Web Viewer — 401 "malformed"

Bug reports
1

Steps to reproduce

  1. Fresh install of Obsidian from the official download page, no community plugins.
  2. Enable the core **Web Viewer** plugin.
  3. Open the Web Viewer and navigate to accounts.google .com (or open any Google Doc/Sheet link while signed out).
  4. Attempt to sign in with a Google account.

Did you read and follow the Troubleshooting Guide?

Yes

Expected result

Google’s sign-in page loads normally and the account can be used (Docs, Sheets, Drive, etc. open in the Web Viewer).

Actual result

Google returns its error page: **“401. That’s an error. The server cannot process the request because it is malformed. It should not be retried.”** Sign-in from inside Obsidian is impossible. This started around the first week of August 2026; before that, signing in from the Web Viewer worked fine for months.

Environment

SYSTEM INFO:

Obsidian version: 1.12.7

Installer version: 1.12.7

Operating system: Darwin Kernel Version 25.5.0: Mon Apr 27 20:39:29 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T8142 25.5.0

Login status: not logged in

Language: en

Insider build toggle: off

Live preview: on

Base theme: adapt to system

Community theme: none

Snippets enabled: 0

Restricted mode: off

Plugins installed: 8

Plugins enabled: 7

1: Iconize v2.14.7

2: Editing Toolbar v4.0.8

3: Web viewer Bookmarks v1.5.0

4: Ribbon Divider v1.1.1

5: Open Tab Settings v2.1.1

6: Native Mover v1.0.0

7: GDocs v1.0.7

RECOMMENDATIONS:

Community plugins: for bugs, please first try updating all your plugins to latest. If still not fixed, please try to make the issue happen in the Sandbox Vault or disable community plugins.

Reproduced on macOS with Obsidian 1.12.7 (Electron 39.8.3) and 1.13.7 (Electron 43.3.0), both from the official installer.

Additional information

Note on authorship*: This report was written with the assistance of an AI agent (Hermes Agent) during a troubleshooting conversation with the reporter. The technical findings, code excerpts, and conclusions presented here are the result of that AI-assisted investigation. The snippets from `obsidian.asar` were extracted directly from the app bundle during the investigation and are quoted verbatim, reformatted only for readability.*

Root cause found in the app bundle

Obsidian registers `webRequest.onBeforeSendHeaders` hooks that mutate every request made by its embedded-browser sessions (`obsidian.asar`; present identically in 1.12.7 and 1.13.7):

Web Viewer session (created via `create-browser-session`):

u.session.setUserAgent(
  u.session.getUserAgent().split(" ")
    .filter(g => !/^(obsidian|electron)/i.test(g)).join(" ")
);
u.session.webRequest.onBeforeSendHeaders({ urls: ["https://*/*", "http://*/*"] }, (g, w) => {
  let { requestHeaders: y } = g;
  for (let E in y)
    E.toLowerCase() === "sec-fetch-dest" || E.toLowerCase() === "sec-ch-ua"
      ? delete y[E]
      : E.toLowerCase() === "user-agent" && g.url.startsWith("https://accounts.google.com/")
        ? (y[E] = "Chrome")          // ← literal "Chrome": a malformed User-Agent
        : null;
  w({ requestHeaders: y });
});

Default session (used by the main app and by plugin webviews without a custom partition):

r.onBeforeSendHeaders({ urls: ["https://*/*", "http://*/*"] }, (t, n) => {

let { requestHeaders: o } = t;

if (t.url.startsWith("
") || t.url.startsWith("https://www.youtube-nocookie.com/embed/"))

    o.Referer || (o.Referer = "md.obsidian");

else

for (let u in o)

      (u.toLowerCase() === "sec-fetch-dest" || u.toLowerCase() === "sec-ch-ua") && delete o[u];

n({ requestHeaders: o });

});

So every embedded-browser request to Google goes out without the `sec-ch-ua` / `sec-fetch-dest` client hints, and requests to `accounts.google.com` additionally carry the literal User-Agent `“Chrome”`. Google’s sign-in endpoints now reject such requests with 401 “malformed”. This used to be tolerated, which is why the breakage only appeared recently (first week of August 2026), while the hooks have existed for much longer.

How this was verified

  1. Clean Electron harness (same Electron family as Obsidian, no Obsidian hooks): signing into Google works with *any* User-Agent, including Obsidian’s own UA (`…obsidian/1.13.4 …Electron/43.x`). The only difference vs. the Web Viewer is the header mutation → the hooks are the trigger.
  2. curl: plain `docs.google.com` pages return 200 with any UA; the login/GSI endpoints return the 401 “malformed” response when the request carries the literal `“Chrome”` UA.
  3. Workaround confirming the cause: a webview with its own `partition` (a session that does not go through these hooks) plus a clean Chrome UA can sign into Google inside Obsidian, while the Web Viewer 401s for the same URL in the same app.
  4. Sandbox vault: the 401 reproduces in a fresh sandbox vault (no community plugins or themes), confirming it is core-app behavior, not vault configuration.

Impact

  • No one can sign in to Google (Docs, Sheets, Drive, Gmail) inside the Web Viewer.
  • Community plugins that embed Google pages via webviews break unless they use a custom partition (undocumented workaround). Example: oilandrust/obsidian-gdocs issue #2, reported the same week.

Request

  1. Stop deleting `sec-ch-ua` / `sec-fetch-dest` from embedded-browser requests (or make it opt-in).
  2. Stop rewriting the User-Agent for `accounts.google.com` to the literal string `“Chrome”`; if a sanitized UA is needed, use a complete, valid UA string.
  3. Ideally, expose a supported way for plugins to create webviews with a clean session/UA.