Your website's "Continue with Google" button is Broken.

[DatScreamer]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

https://console.ory.sh/login

Describe the bug

Oauth/OIDC callback doesn't create an account after Google account authorization (see reproduction steps for more info)

Reproducing the bug

Reproduction steps:

https://www.ory.sh/hydra/ "Join the chat on Slack" button --> "Log in to Ory Network" Button --> "Continue with Google" button --> Authorize with Google --> (This is the issue) Redirects back to "Log in to your account" page instead of creating a new account with the information from the Google Oauth/OIDC callback

Browser: Latest Brave browser on MacOS (latest macOS version)
Also broken on Chrome.

Relevant log output

/login?flow=13ba37c6-555e-474c-ac93-9891fb36cf20:1 [Report Only] Refused to load the script 'https://consent.ory.sh/index.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://sst.ory.sh https://ory.sh https://www.ory.sh https://js.stripe.com https://sqa-web.ory.sh https://cdn.jsdelivr.net https://static.cloudflareinsights.com https://eu.posthog.com https://api.console.ory.sh https://app.termly.io https://static.reo.dev/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

login:1 [Report Only] Refused to load the script 'https://consent.ory.sh/cmp/init.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://sst.ory.sh https://ory.sh https://www.ory.sh https://js.stripe.com https://sqa-web.ory.sh https://cdn.jsdelivr.net https://static.cloudflareinsights.com https://eu.posthog.com https://api.console.ory.sh https://app.termly.io https://static.reo.dev/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

login:1 
            
            
           GET https://static.cloudflareinsights.com/beacon.min.js/[redacted] net::ERR_BLOCKED_BY_CLIENT
init.js:1 [Report Only] Refused to load the script 'https://consent.ory.sh/cmp/m.js?z=[redacted]...[redacted]' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://sst.ory.sh https://ory.sh https://www.ory.sh https://js.stripe.com https://sqa-web.ory.sh https://cdn.jsdelivr.net https://static.cloudflareinsights.com https://eu.posthog.com https://api.console.ory.sh https://app.termly.io https://static.reo.dev/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

np.min.js:36 
            
            
           POST https://sqa-web.ory.sh/np.php?action_name=Ory%20Console&idsite=2&rec=1&r=231445&h=15&m=7&s=48&url=https%3A%2F%2Fconsole.ory.sh%2Flogin%3Fflow%[redacted]&urlref=https%3A%2F%2Faccounts.google.com%2F&_id=[redacted]&_idn=0&send_image=0&_refts=[redacted]&_ref=https%3A%2F%2Fslack.ory.sh%2F&pv_id=[redacted]_net=0&pf_srv=145&pf_tfr=1&pf_dm1=130&uadata=%7B%22formFactors%22%3A%5B%22Desktop%22%5D%2C%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22134.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%2C%7B%22brand%22%3A%22Brave%22%2C%22version%22%3A%22134.0.0.0%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22macOS%22%2C%22platformVersion%22%3A%2215.3.2%22%7D&pdf=0&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1442x1170 net::ERR_BLOCKED_BY_CLIENT
bh @ np.min.js:36
(anonymous) @ np.min.js:39
c0 @ np.min.js:38
bS @ np.min.js:39
ay @ np.min.js:40
(anonymous) @ np.min.js:38
Promise.then
cG @ np.min.js:38
c6 @ np.min.js:40
cL @ np.min.js:45
cd @ np.min.js:48
(anonymous) @ np.min.js:64
cw @ np.min.js:52
U.trackPageView @ np.min.js:64
ak @ np.min.js:12
ai @ np.min.js:69
addTracker @ np.min.js:71
(anonymous) @ np.min.js:75
(anonymous) @ np.min.js:75
_app-153a884fb3f3ded4.js:113 
            
            
           GET https://project.console.ory.sh/sessions/whoami 401 (Unauthorized)
(anonymous)
            
           POST https://r.stripe.com/b net::ERR_BLOCKED_BY_CLIENT
(anonymous)
            
           POST https://r.stripe.com/b net::ERR_BLOCKED_BY_CLIENT
(anonymous)
           POST https://r.stripe.com/b net::ERR_BLOCKED_BY_CLIENT
(anonymous) 
           POST https://o481709.ingest.sentry.io/api/5738219/envelope/?sentry_version=7&sentry_key=74f1c321bc7149a897ef0ee748f9c7a5&sentry_client=sentry.javascript.nextjs%2F9.5.0 net::ERR_BLOCKED_BY_CLIENT

Relevant configuration

N/A

Version

N/A

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

None

Additional Context

No response