Add extension package that strips external JS loading #7766

NhienLam · 2023-11-09T17:37:52Z

Add an Extension package for developers to use when building a Chrome extension app.

This package strips the external JS loading to avoid violating Chrome Web Store's policy about remotely hosted code.
https://developer.chrome.com/docs/extensions/develop/migrate/improve-security#remove-remote-code

changeset-bot · 2023-11-09T17:37:56Z

⚠️ No Changeset found

Latest commit: 26634a4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

google-oss-bot · 2023-11-09T17:53:12Z

Size Report ¹

Affected Products

`@firebase/auth`

Type	Base (`895d0cf`)	Merge (`0c5a2d7`)	Diff
browser	177 kB	177 kB	+639 B (+0.4%)
cordova	205 kB	205 kB	-100 B (-0.0%)
esm5	230 kB	231 kB	+756 B (+0.3%)
main	174 kB	174 kB	-88 B (-0.1%)
module	177 kB	177 kB	+639 B (+0.4%)
react-native	194 kB	194 kB	+163 B (+0.1%)

@firebase/auth/cordova
Type Base (895d0cf) Merge (0c5a2d7) Diff
browser 205 kB 205 kB -100 B (-0.0%)
module 205 kB 205 kB -100 B (-0.0%)
@firebase/auth/internal
Type Base (895d0cf) Merge (0c5a2d7) Diff
browser 188 kB 188 kB +639 B (+0.3%)
esm5 244 kB 244 kB +756 B (+0.3%)
main 211 kB 210 kB -84 B (-0.0%)
module 188 kB 188 kB +639 B (+0.3%)
@firebase/auth/web-extension
Type Base (895d0cf) Merge (0c5a2d7) Diff
browser ? 133 kB ? (?)
main ? 148 kB ? (?)
module ? 133 kB ? (?)

`bundle`

Type	Base (`895d0cf`)	Merge (`0c5a2d7`)	Diff
auth (Anonymous)	73.7 kB	73.8 kB	+41 B (+0.1%)
auth (EmailAndPassword)	81.6 kB	82.0 kB	+442 B (+0.5%)
auth (GoogleFBTwitterGitHubPopup)	100 kB	101 kB	+437 B (+0.4%)
auth (GooglePopup)	97.6 kB	98.1 kB	+437 B (+0.4%)
auth (GoogleRedirect)	97.8 kB	98.3 kB	+437 B (+0.4%)
auth (Phone)	84.0 kB	84.4 kB	+420 B (+0.5%)

`firebase`

Type	Base (`895d0cf`)	Merge (`0c5a2d7`)	Diff
firebase-auth-compat.js	136 kB	137 kB	+385 B (+0.3%)
firebase-auth-cordova.js	174 kB	174 kB	-75 B (-0.0%)
firebase-auth-web-extension.js	?	114 kB	? (?)
firebase-auth.js	147 kB	147 kB	+537 B (+0.4%)
firebase-compat.js	780 kB	780 kB	+385 B (+0.0%)

Test Logs

https://storage.googleapis.com/firebase-sdk-metric-reports/AAxpMIin1V.html

google-oss-bot · 2023-11-09T18:05:58Z

Size Analysis Report ¹

This report is too large (92,343 characters) to be displayed here in a GitHub comment. Please use the below link to see the full report on Google Cloud Storage.

Test Logs

https://storage.googleapis.com/firebase-sdk-metric-reports/LOM9Rct2bN.html

hsubox76

So sorry this is so complicated but you'll have to add the firebase entry points as well. That means, make a copy of the packages/firebase/cordova directory (index.ts and package.json), and add an entry in packages/firebase/package.json copying cordova here: https://github.com/firebase/firebase-js-sdk/blob/master/packages/firebase/package.json#L74. These can be an exact copy of cordova (with the word "extension") subbed in as it's all self-referencing within packages/firebase and not related to the bundles and paths you have created within the auth package. So you don't have to worry about extension-cjs and extension-esm2017 etc.

packages/auth/package.json

packages/auth/extension/package.json

packages/auth/package.json

packages/firebase/package.json

NhienLam · 2023-11-10T01:23:59Z

Thanks Christina! I addressed your comments and added an extension entry point to firebase/auth.

packages/auth/extension/package.json

packages/auth/package.json

packages/firebase/package.json

packages/firebase/auth/extension/index.ts

prameshj

LGTM except for a couple of small comments.

prameshj · 2023-12-08T23:50:59Z

packages/auth/extension/package.json

@@ -0,0 +1,8 @@
+{
+    "name": "@firebase/auth/extension",


nit: maybe call this "chrome-extension"? extension would be interpreted to mean it is some additional auth functionality.

Ack. Renamed 'extension' to 'chrome-extension' here and other places (including folders' names). Thanks!

web-extension would be the preferred nomenclature. Since I presume we would want these to work in firefox and safari

While Firebase Auth only supports Chrome extensions currently, I changed it to 'web-extension' in case we support other web extensions in the future. Thanks!

absolutely understand, appreciate the update

packages/auth/extension/package.json

prameshj · 2023-12-08T23:54:36Z

packages/auth/index.extension.ts

+
+import { ClientPlatform } from './src/core/util/version';
+
+import { browserSessionPersistence } from './src/platform_browser/persistence/session_storage';


session storage does not work in chrome extension(https://developer.chrome.com/docs/extensions/reference/api/storage#usage only mentions local storage and doesn't recommend it). we could remove this.

Ack. Removed.

FWIW - you can't use localStorage by default, since it doesn't exist in service workers, but you can use chrome.storage, which does have session storage.

renkelvin · 2024-01-22T21:48:14Z

packages/auth/src/platform_browser/index.ts

+  gapiScript: 'https://apis.google.com/js/api.js',
+  recaptchaV2Script: 'https://www.google.com/recaptcha/api.js',
+  recaptchaEnterpriseScript:
+    'https://www.google.com/recaptcha/enterprise.js?render='


Is ?render= needed?

Yes, I copied the exact url from https://github.com/firebase/firebase-js-sdk/blob/master/packages/auth/src/platform_browser/recaptcha/recaptcha_enterprise_verifier.ts#L35.

The full url we need to pass in _loadJS is 'https://www.google.com/recaptcha/enterprise.js?render=SITE-KEY'.

So if we remove '?render=' from here, we will have to update this line to be

url += '?render=' + siteKey;

…sm5 from rollup file

NhienLam requested review from lisajian, prameshj, renkelvin, sam-gc and a team as code owners November 9, 2023 17:37

NhienLam marked this pull request as draft November 9, 2023 17:38

hsubox76 reviewed Nov 9, 2023

View reviewed changes

NhienLam commented Nov 10, 2023

View reviewed changes

packages/firebase/package.json Outdated Show resolved Hide resolved

hsubox76 reviewed Nov 10, 2023

View reviewed changes

packages/auth/extension/package.json Outdated Show resolved Hide resolved

packages/auth/package.json Outdated Show resolved Hide resolved

packages/firebase/package.json Outdated Show resolved Hide resolved

packages/firebase/auth/extension/index.ts Outdated Show resolved Hide resolved

NhienLam marked this pull request as ready for review December 5, 2023 00:59

NhienLam requested a review from Xiaoshouzi-gh December 6, 2023 18:48

prameshj reviewed Dec 9, 2023

View reviewed changes

NhienLam force-pushed the nhienlam/auth/extension branch from 97bde31 to ff46266 Compare December 12, 2023 01:59

prameshj approved these changes Dec 13, 2023

View reviewed changes

hsubox76 approved these changes Jan 22, 2024

View reviewed changes

renkelvin approved these changes Jan 22, 2024

View reviewed changes

sam-gc and others added 8 commits January 24, 2024 13:52

Add extension package that strips external JS loading

914216c

Strip recaptcha enterprise script and unsupported methods in extension

c82c6f3

Remove signInWithRedirect from Extension package and dist/extension-e…

1d9f9e2

…sm5 from rollup file

Add extension entry point to firebase/auth

ee0167b

Resolve comments

f8ee64b

Rename 'extension' to 'chrome-extension'

baf695b

Fix test

12ffe84

Rename 'chrome-extension' to 'web-extension

26634a4

NhienLam force-pushed the nhienlam/auth/extension branch from 9fcd5d8 to 26634a4 Compare January 24, 2024 22:27

NhienLam merged commit e929e3f into master Jan 24, 2024
43 of 44 checks passed

NhienLam deleted the nhienlam/auth/extension branch January 24, 2024 23:28

This was referenced Jan 25, 2024

Refactor _loadJS out of the library by default #7976

Closed

Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js externally from the Google API in the src/index.js file. #7617

Closed

firebase locked and limited conversation to collaborators Feb 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add extension package that strips external JS loading #7766

Add extension package that strips external JS loading #7766

NhienLam commented Nov 9, 2023 •

edited

Loading

changeset-bot bot commented Nov 9, 2023 •

edited

Loading

google-oss-bot commented Nov 9, 2023 •

edited

Loading

`@firebase/auth`

`@firebase/auth/cordova`

`@firebase/auth/internal`

`@firebase/auth/web-extension`

`bundle`

`firebase`

google-oss-bot commented Nov 9, 2023 •

edited

Loading

hsubox76 left a comment

NhienLam commented Nov 10, 2023

prameshj left a comment

prameshj Dec 8, 2023

NhienLam Dec 12, 2023

patrickkettner Dec 29, 2023

NhienLam Jan 9, 2024

patrickkettner Jan 11, 2024

prameshj Dec 8, 2023

NhienLam Dec 12, 2023

patrickkettner Dec 29, 2023

renkelvin Jan 22, 2024

NhienLam Jan 22, 2024


		import { ClientPlatform } from './src/core/util/version';

		import { browserSessionPersistence } from './src/platform_browser/persistence/session_storage';

Add extension package that strips external JS loading #7766

Add extension package that strips external JS loading #7766

Conversation

NhienLam commented Nov 9, 2023 • edited Loading

changeset-bot bot commented Nov 9, 2023 • edited Loading

⚠️ No Changeset found

google-oss-bot commented Nov 9, 2023 • edited Loading

Size Report 1

Affected Products

@firebase/auth

@firebase/auth/cordova

@firebase/auth/internal

@firebase/auth/web-extension

bundle

firebase

Test Logs

google-oss-bot commented Nov 9, 2023 • edited Loading

Size Analysis Report 1

Test Logs

hsubox76 left a comment

Choose a reason for hiding this comment

NhienLam commented Nov 10, 2023

prameshj left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NhienLam commented Nov 9, 2023 •

edited

Loading

changeset-bot bot commented Nov 9, 2023 •

edited

Loading

google-oss-bot commented Nov 9, 2023 •

edited

Loading

Size Report ¹

`@firebase/auth`

`@firebase/auth/cordova`

`@firebase/auth/internal`

`@firebase/auth/web-extension`

`bundle`

`firebase`

google-oss-bot commented Nov 9, 2023 •

edited

Loading

Size Analysis Report ¹