Cannot remove remote scripts when using Firebase Auth with web-extension import in Manifest V3

[dyskinmel]

Operating System

macOS Sequoia 15.5

Environment (if applicable)

Chrome 137.0.7151.120

Firebase SDK Version

11.9.1

Firebase SDK Product(s)

Auth

Project Tooling

Developing Google Chrome Extension with vite.

Detailed Problem Description

I think this is related to #7617

I changed my import to firebase/auth/web-extension as follows:

import {
  sendSignInLinkToEmail,
  signInWithEmailLink,
  isSignInWithEmailLink,
  signOut,
  onAuthStateChanged,
} from 'firebase/auth/web-extension';

However, the following remotely hosted scripts are still included in the built code, which causes my Chrome Web Store submission to be rejected for violating the Manifest V3 policy against remote code:

gapiScript:"https://apis.google.com/js/api.js",recaptchaV2Script:"https://www.google.com/recaptcha/api.js",recaptchaEnterpriseScript:"https://www.google.com/recaptcha/enterprise.js?render="});

The following is the violation notice I received.

Violation(s):

Violation reference ID: [Blue Argon](https://developer.chrome.com/docs/webstore/troubleshooting/#additional-requirements-for-manifest-v3)

Technical Requirements - Additional Requirements for Manifest V3:

Violation:
Including remotely hosted code in a Manifest V3 item.
Violating Content:
Code snippet: popup.js: https://apis.google.com/js/api.js , https://www.google.com/recaptcha/api.js , https://www.google.com/recaptcha/enterprise.js?render=

I suspect I’m missing something, but I have no idea how to prevent this.
Any advice or recommended approach would be greatly appreciated!

I'm also importing following from firebase

import { initializeApp } from 'firebase/app';
import { getAuth, connectAuthEmulator } from 'firebase/auth/web-extension';
import { getFirestore, connectFirestoreEmulator } from 'firebase/firestore';
import {
  getFunctions,
  connectFunctionsEmulator,
  httpsCallable,
} from 'firebase/functions';

Thank you very much in advance!

Steps and code to reproduce issue

N/A

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[jbalidiong]

Hi @dyskinmel, thank you for reaching out to us. Upon checking the error, it seems that you're using reCAPTCHA. According to the linked issue provided above: "..the enterprise.js is for reCAPTCHA enterprise. The script will only load if you use reCAPTCHA enterprise." In our documentation:

The following sign in methods are also supported but require some additional work:

• Sign in with a pop-up window (signInWithPopup, linkWithPopup, and reauthenticateWithPopup)
• Sign in by redirecting to the sign-in page (signInWithRedirect, linkWithRedirect, and reauthenticateWithRedirect)
• Sign in with Phone Number with reCAPTCHA
• SMS multi-factor authentication with reCAPTCHA
• reCAPTCHA Enterprise protection

You can use Offscreen Documents if you'll be using these methods in a Manifest V3 Chrome extension. If it still persist, can you give more information about the violation?

[dyskinmel]

Hi @jbalidiong, thank you very much for your reply!

I’m only importing and using the following from firebase/auth/web-extension, and I’m not using reCAPTCHA Enterprise (this app is not registered with App Check either):

  sendSignInLinkToEmail,
  signInWithEmailLink,
  isSignInWithEmailLink,
  signOut,
  onAuthStateChanged,
  getAuth, 
  connectAuthEmulator

Given this, would it still be considered as using reCAPTCHA or reCAPTCHA Enterprise?

Is there a way to explicitly disable or avoid the use of reCAPTCHA Enterprise?
Also, is there any way to trace where in the SDK or in my code reCAPTCHA Enterprise might be getting triggered?

Sorry for the repeated questions, but I would really appreciate any guidance you could provide.

Thank you again for your support!