Auth: migration from localstorage to indexedDb not good when used in iframe

[RomainVialard]

[REQUIRED] Describe your environment

• Firebase SDK version: 4.12.1
• Firebase Product: auth

[REQUIRED] Describe the problem

Between SDK version 4.11 & 4.12, it was decided to migrate auth storage from localstorage to indexedDb (see PR #530).

I am using the Firebase JS SDK inside an iframe and this migration is causing issues when trying to authenticate to Firebase (using method signInWithCustomToken() but I'm assuming the issue happens with all sign-in methods as it is related to client side storage).

Specifically, between 4.11 & 4.12, authentication now fails with an indexedDb error if:

• In Chrome: third-party cookies are blocked (not default)
• In Safari: cookies are set to "Allow from websites I visit". Switching to "Always allow" fixes the issue (but default setting is "Allow from websites I visit")

Error thrown by Safari:
SecurityError: IDBFactory.open() called in an invalid security context

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[google-oss-bot]

Hmmm this issue does not seem to follow the issue template. Make sure you provide all the required information.

[bojeil-google]

Thanks for reporting. We'll look into the errors when indexedDB is not functional.

[bojeil-google]

We will add a fallback to localStorage when indexedDB fails to open with an error.

Regarding Safari iframes, you are expected to have visited the site in a top level window as you mentioned. This is a limitation that Safari set. Safari also uses intelligent tracking (to protect privacy) and will clear cookies and data in your iframe after a certain period of time. There are a lot of issues which even localStorage won't solve.

There are many reasons we switched to indexedDB, and one major reason is the compatibility with service workers which all major modern browsers are now supporting including Apple which has finally started supporting them. Going forward, Auth must be compatible with service workers.

[RomainVialard]

Thank you!

[dfischer]

Confirming I am seeing the same issue

[vieira]

Hello,

Has this been fixed in 4.13?

Thanks.

[wti806]

Yes. It should be fixed in 4.13.

…

On Thu, Apr 26, 2018 at 6:37 AM João Vieira ***@***.***> wrote: Hello, Has this been fixed in 4.13? Thanks. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#631 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Ae5hip7Y7qivm4GGTqpHovntoEDdArCHks5tsc2ZgaJpZM4TG0Ld> .

[jshcrowthe]

Closing as it seems this has been fixed.