firebase / firebase/firebase-tools
__FIREBASE_DEFAULTS__ not available when app in iframe
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.3k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 84
Description
### [REQUIRED] Environment info
**firebase-tools:**
12.5.4
**Platform:**
ChromeOS/Linux
### [REQUIRED] Test case
1) Create a starter firebase project w/experimental frameworks (e.g. nextjs or vite)
2) Add a call to initializeApp() with no args.
3) Run the emulators
Load the app in a tab/window, should be OK.
4) Iframe the app, but host the iframe elsewhere
5) Load the outer page
### [REQUIRED] Steps to reproduce
See above
### [REQUIRED] Expected behavior
initializeApp() call is successful.
### [REQUIRED] Actual behavior
initializeApp() fails due to missing configuration.
I suspect this is due to the samesite policy on the __FIREBASE_DEFAULTS__ cookie. In devtools, it has a samesite=strict policy which requires the cookie domain match the URL bar. That makes the config unavailable in the iframe.
Please consider changing to samesite=lax or at least give a way to override it.
Contributor guide
Assessment
This issue has not been assessed yet.