1
votes

I am working on a chrome extension and was about to set up identity authentication when I saw they put a notification on top of the page saying they are migrating authentication to firebase: https://firebase.google.com/docs/web/setup#prerequisites

I'm trying to follow their advice for the "web setup" but I am thinking it must not be the same for extensions because trying to put the initialization code in my background.js I am getting the error:

Refused to load the script 'https://www.gstatic.com/firebasejs/live/3.0/firebase.js' because it violates the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:".

Am I loading it in the wrong place or is there simply a different implementation for extensions?

Here is the code to avoid link rot:

// TODO: Replace with your project's customized code snippet
<script src="https://www.gstatic.com/firebasejs/3.0.2/firebase.js"></script>
<script>
// Initialize Firebase
var config = {
  apiKey: '<your-api-key>',
  authDomain: '<your-auth-domain>',
  databaseURL: '<your-database-url>',
  storageBucket: '<your-storage-bucket>'
};
firebase.initializeApp(config);

I replaced it with my own custom code snippet and I put the embedded link in background.html with the config/init snippit in background.js

2

2 Answers

1
votes

You need to download firebase.js and put in in your extension, then load it with a relative url. Your extension isn't allowed to access external scripts.

1
votes

add this to your manifest.json:

"content_security_policy":"script-src 'self' https://www.gstatic.com/ https://*.firebaseio.com https://www.googleapis.com; object-src 'self'"

this way you will not violates the Content Security Policy as mention in the error you got.