Firefox error on signInWithCustomToken with empty referer: auth/requests-from-referer-<empty>-are-blocked

[CharlieDigital]

Operating System

Mac M1, macOS 14.5

Browser Version

Firefox 129.0

Firebase SDK Version

10.12.5

Firebase SDK Product:

Auth

Describe your project's tooling

Vue + Vite building a browser extension

Describe the problem

When making a call to signInWithCustomToken, Firebase auth receives an HTTP 403 from the identity endpoint with the following error:

This only occurs in Firefox and works as expected on Chrome.

Steps and code to reproduce issue

I have the code published in the following extensions (with minimal obfuscation):

Chrome version of the extension where everything works: https://chromewebstore.google.com/detail/turasapp/lpfijfdbgohlblnadiokliolkkeeblpo

Firefox version: https://addons.mozilla.org/en-US/firefox/addon/turas-app/

There is no functional difference in the output code.

May be related to this issue: #7997

[cabello]

Facing similar issue with await signInWithCustomToken(auth, customFirebaseToken) on Windows 10 + Chrome 126 and 127.
We issue the token in the backend using a service account and then use signInWithCustomToken using the client side API that is configured with a browser key that is restricted for our sites.
I don't see the option to supply a referer in this case.

[dlarocque]

Hi @CharlieDigital, it looks like https://addons.mozilla.org/en-US/firefox/addon/turas-app/ does not exist. Do you have another version we can take a look at?

[CharlieDigital]

Yup; I took it offline for the time being, but I've attached the compiled source here (largely identical except for the manifest):

turas-firefox-2024-09-14-16-39.zip

Appreciate any effort your team puts into this!