Firestore Breaking in Chrome 80+ in Chrome Extension

[scottfr]

Describe your environment

• Operating System version: NA
• Browser version: Chrome 80/81
• Firebase SDK version: 7.6.2
• Firebase Product: firestore

Describe the problem

Chrome is reworking how extension network requests work. Previously, requests would have an origin of chrome-extension://IDXYZ but now they have an origin equal to the domain of the requested resource when the extension requests access to all resources. See here https://bugs.chromium.org/p/chromium/issues/detail?id=966223

If you are using Firestore in an extension background script and have the all_urls permission, this will now result in the origin on the Firestore requests being https://firestore.googleapis.com.

When this happens, Firestore hard fails with the error FirebaseError: Missing or insufficient permissions. when requests are made. (Potentially related to this issue #1491?). Note the exact same code worked perfectly find in Chrome 79 and earlier.

Extension review and deployment times can take several weeks, so we need a fix for this issue quickly if we need to make client side changes prior to Chrome 80.

Hopefully this can be fixed on the Firestore backend though as there is probably a lot of code out there in various extensions that might break.

Steps to reproduce:

• Use Chrome 81 (I've confirmed the issue on Chrome 81 Canary, but users report it on 80 too)
• Make sure this flag is enabled: chrome://flags/#out-of-blink-cors (it appears to be deployed as an experiment to some fraction of users)
• Try to use Firestore with rules in an extension background script

[wu-hui]

Hi @scottfr,

Thanks for reporting the issue! I could not reproduce your issue following your steps though.

I suspect certain rules will trigger this: can you show me your collection/document layout and the security rules your are using, and in what operation do you see the errors.

It'd be even better if you could provide a minimum reproducing project, in a github repository for example.

Thanks.

[mikelehen]

@scottfr Thanks for the report! This sounds very similar / related to #1491.

I suspect they have the same underlying cause (due to a backend limitation, the Firestore SDK can't use $httpHeaders when the Origin is missing) and I'll try to put together a PR today that disables our $httpHeaders code for Chrome Extensions.

If you happen to have a trivial repro, that would help me to validate the fix, else I'll probably just check for typeof chrome == 'object' && chrome.extension and hope that's sufficient. 😄

In any case, please follow #1491 for updates.