Enforce authTokenSyncURL being a path and not a url.

[hsubox76]

The _authTokenSyncURL property coming from the FIREBASE_DEFAULTS autoinit (for frameworks tooling) should only point to the same domain and be a relative path. Do not set the cookie if this is not a relative path (such as if it is a full url), as this could be a possible vulnerability.

See b/327386166

[changeset-bot]

🦋 Changeset detected

Latest commit: d8cac08

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@firebase/auth	Patch
@firebase/auth-compat	Patch
firebase	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[google-oss-bot]

Size Report ¹

Affected Products

• @firebase/auth

  Type	Base (e60188d)	Merge (0088e11)	Diff
  browser	177 kB	177 kB	+38 B (+0.0%)
  esm5	231 kB	231 kB	+38 B (+0.0%)
  module	177 kB	177 kB	+38 B (+0.0%)

• @firebase/auth/internal

  Type	Base (e60188d)	Merge (0088e11)	Diff
  browser	188 kB	188 kB	+38 B (+0.0%)
  esm5	244 kB	244 kB	+38 B (+0.0%)
  module	188 kB	188 kB	+38 B (+0.0%)

• bundle

  Type	Base (e60188d)	Merge (0088e11)	Diff
  auth (GoogleFBTwitterGitHubPopup)	101 kB	101 kB	+19 B (+0.0%)

• firebase

  Type	Base (e60188d)	Merge (0088e11)	Diff
  firebase-auth.js	147 kB	147 kB	+19 B (+0.0%)

Test Logs

• Base (e60188d): https://github.com/firebase/firebase-js-sdk/actions/runs/8086709249
• Merge (0088e11): https://github.com/firebase/firebase-js-sdk/actions/runs/8161396207

1. https://storage.googleapis.com/firebase-sdk-metric-reports/98RFFgD1tY.html

[google-oss-bot]

Size Analysis Report ¹

Affected Products

• @firebase/auth

  • getAuth

    Size

    Type	Base (e60188d)	Merge (0088e11)	Diff
    size	72.4 kB	72.4 kB	+19 B (+0.0%)
    size-with-ext-deps	100 kB	100 kB	+19 B (+0.0%)

Test Logs

• Base (e60188d): https://github.com/firebase/firebase-js-sdk/actions/runs/8086709249
• Merge (0088e11): https://github.com/firebase/firebase-js-sdk/actions/runs/8161396207

1. https://storage.googleapis.com/firebase-sdk-metric-reports/iB521IhizP.html