None of the third-party storage mitigations are workable

[pb-jeff-oneill]

First, a big thank you to the firebaseui-web team for creating a great library.

This is a follow up to issue 2 described here:
#977 (comment)

There are 5 "mitigations" to this issue described by the Firebase team.

Unfortunately none of them are workable:

1. I'm not using Firebase hosting.
2. Popups are sometimes blocked and less good for mobile.
3. My CSP (content security policy) doesn't allow inline javascript and Firebase uses inline javascript on the proxied page.
4. I need SAML.
5. This equates to not using firebaseui-web

Is there a better solution in the works?

I've been otherwise happy with firebaseui-web and really don't want to migrate to something else.

[prameshj]

Hi Jeff, thanks for filing this.

The mitigations listed are best-practices going forward to use and future-proof signInWithRedirect flows.

One note about inline javascript - the previous version (where .firebaseapp.com/__/auth/handler" is used) also uses inline javascript, the same code is now being run in the app domain, once you proxy/self-host the files.

In case you self-host the files, you could add a nonce to the inline js in the file https://<project>.firebaseapp.com/__/auth/handler to allowlist this in CSP - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script

Is this an option?

[pb-jeff-oneill]

Hi @prameshj, thanks for responding.

By self-host, are you referring to mitigation #4? I need SAML so mitigation #4 is not an option for me.

The nonce solution is not possible with the proxy solution in mitigation #3. Aside from CSP, requiring a reverse proxy to set up auth is a heavy requirement. A simpler solution is needed.

I think I'm still stuck with no good solution.

[dcoleyoung]

The docs show firebase ui using popup by default
// Will use popup for IDP Providers sign-in flow instead of the default, redirect. signInFlow: 'popup',

https://firebase.google.com/docs/auth/web/firebaseui

Is there something else that needs to be updated for this mitigation (Option 2)

The issues still exists for me using the default implementation. Please advise changes to the example given in the docs.

[rachelmyers]

I think this has been resolved by more recent releases; try upgrading to 6.0.2 and reopen if this is still a problem.