(Firefox extension) Error: Not allowed to define cross-origin object as property on [Object] or [Array] XrayWrapper

[CharlieDigital]

Operating System

Mac M1, macOS 14.5

Browser Version

Firefox 129.0

Firebase SDK Version

10.12.4

Firebase SDK Product:

Auth

Describe your project's tooling

Vue, Vite

Describe the problem

Firebase auth seems to fail at code startup when making a heartbeat call to IndexDB:

Error message:

Error: Not allowed to define cross-origin object as property on [Object] or [Array] XrayWrapper

Call is being made from a Vue component injected into a browser page via content script.

The code works fine in Chrome and in Firefox locally against the Firebase emulator in local development.

This failure to connect to the IndexDB appears to then affect the call to signInWithCustomToken at a later juncture in the code (not certain that they are related):

Steps and code to reproduce issue

I'm in the process of creating a reproducible sample, but so far I've only observed this with a published extension (everything works fine when working locally and connected to the emulator as it does not care about the referrer).

Chrome version of the extension: https://chromewebstore.google.com/detail/turasapp/lpfijfdbgohlblnadiokliolkkeeblpo

Firefox version: https://addons.mozilla.org/en-US/firefox/addon/turas-app/

Both are non-obfuscated so it should be possible to step through the source in the file maps-connector.js

[CharlieDigital]

Follow on error seems to be related to this earlier issue: #7997

Here is the error in Firefox:

Network request is sent and response is received as an HTTP 403 due to empty referrer in the request.

Stack:

[hsubox76]

We should never error the user in heartbeats code. We should probably gracefully fail in this case - most likely wrap this call in a try/catch. Maybe we should wrap the entirety of triggerHeartbeat in a try/catch and log the error at debug loglevel.

[CharlieDigital]

@hsubox76 would the failure to access IndexDB then affect the subsequent call to the auth API endpoint (identitytoolkit.google.com)? The <empty> referrer is currently preventing the code from working in FF and I haven't determined yet whether this is definitively related to the failure to IndexDB.

[hsubox76]

No product code depends on heartbeats code, it's independent. Several other products use the native indexedDB API, and if indexedDB has limitations in this environment (firefox extension), then those products may have their own problems, which should be addressed separately.

[CharlieDigital]

I'll file a separate issue for it then.