🧩 Plasmo Developers•9mo ago

Extension rejected by Google due to RHC violation in Firebase Auth

We have been building an extension which uses Firebase ecosystem. Recently we tried submitting the extension to Google but we got a rejection due to Remotely Hosted Code. Details are as follow:

Hi there,

We regret to inform you that the most recent
submission of your item was rejected. Please find the
details below.
Item name: ****
Item ID: ***************

Violation(s):
Violation reference ID: Blue Argon
Technical Requirements - Additional
Requirements for Manifest V3:
Violation: Including remotely hosted code in a
Manifest V3 item.

Violating Content:
Code snippet: popup.100f6462.js:
https://www.google.com/recaptcha/api.js??
${(0,a.querystring)({onload:rW,
render:%22explicit%22,hl:t})},
https://www.google.com/
recaptcha/enterprise.js?
render=,https://apis.google.com/js/api.js?
onload=${t}

Hi there,

We regret to inform you that the most recent
submission of your item was rejected. Please find the
details below.
Item name: ****
Item ID: ***************

Violation(s):
Violation reference ID: Blue Argon
Technical Requirements - Additional
Requirements for Manifest V3:
Violation: Including remotely hosted code in a
Manifest V3 item.

Violating Content:
Code snippet: popup.100f6462.js:
https://www.google.com/recaptcha/api.js??
${(0,a.querystring)({onload:rW,
render:%22explicit%22,hl:t})},
https://www.google.com/
recaptcha/enterprise.js?
render=,https://apis.google.com/js/api.js?
onload=${t}

So we debugged and identified that all recaptcha related RHC calls are coming from firebase packages. Can someone please assist how we can avoid this violation?

16 Replies

Arcane•9mo ago

@HBS has reached level 1. GG!

HBSOP•9mo ago

Turned out I needed to use firebase/auth/web-extension and firebase JS package 10.8 onwards

Avi•9mo ago

I tried to do the same but I got

HBSOP•9mo ago

Make sure you import everything from auth/web-extension even you import any minor thing from firebase/auth would result RHC code references After you build. Open your build folder and search for recaptcha related urls before you submit to google. In my case I was importing a user type from firebase/auth package and due to this I was getting references of RHC urls(recaptcha related) in my build. So I removed all imports from firebase/auth

Avi•9mo ago

Is there a way to import UserCredentials from another module?

HBSOP•9mo ago

You mean UserCredentials interface? In my case I had to import User type. I declared it locally for now. Hopefully types would be exported from firebase/auth/web-extensions soon.

Avi•9mo ago

If I understand correctly, I have to post process the build? Like, building without importing @firebase/auth is not enough

HBSOP•9mo ago

No post process is required as long as you are only importing from firebase/auth-web-extension this is to make sure that RHC reference is not in build and before we submit to Google we can doublecheck

Arcane•9mo ago

@HBS has reached level 2. GG!

Avi•9mo ago

I'm willing to not import the type to make it simpler, or alternatively contribute to https://npm.im/@firebase/auth

npm

@firebase/auth

The Firebase Authenticaton component of the Firebase JS SDK.. Latest version: 1.7.1, last published: 6 days ago. Start using @firebase/auth in your project by running npm i @firebase/auth. There are 105 other projects in the npm registry using @firebase/auth.

Avi•9mo ago

Yesterday I tried to push an update after completely removing any @firebase/auth references, but still got the error

HBSOP•9mo ago

In your node_modules search for RHC url(..../recaptcha/enterprise.js). To identify which other package is using this url

Avi•9mo ago

Ok, as it turned out, I had

import { signOut } from "@firebase/auth";

import { signOut } from "@firebase/auth";

in the background script 🙈 The rest of the @firebase/auth/web-extension imports were from a dedicated Firebase script Now that I found out about the aforementioned import, I consolidated it into the dedicated script, and sure enough, the URL is no longer present in the build

HBSOP•9mo ago

There you go

James•8mo ago

hi everyone, i'm building login with twitter using firebase but if's not easy for config, does we have any docs for config firebase twitter auth in plasmo. Thank guys so much

Avi•8mo ago

I think it should be the same procedure as with the Google auth Basically, you need to use chrome.identity.launchWebAuthFlow() while supplying the corresponding Twitter login URL

Gaming

Programming

Extension rejected by Google due to RHC violation in Firebase Auth