@firebase/auth 1.6.2-canary.1eb302f5a → 1.6.2-canary.9ca1a4e4f

package/dist/rn/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var app = require('@firebase/app');
-var index = require('./index-f3976797.js');
+var index = require('./index-bb64bc87.js');
 var tslib = require('tslib');
 require('@firebase/util');
 require('@firebase/component');

package/dist/rn/internal.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var index = require('./index-f3976797.js');
+var index = require('./index-bb64bc87.js');
 var tslib = require('tslib');
 var util = require('@firebase/util');
 var app = require('@firebase/app');
@@ -3010,14 +3010,19 @@ function getAuth(app$1) {
         ]
     });
     var authTokenSyncPath = util.getExperimentalSetting('authTokenSyncURL');
-    // Don't allow urls (XSS possibility), only paths on the same domain
-    // (starting with a single '/')
-    if (authTokenSyncPath && authTokenSyncPath.match(/^\/[^\/].*/)) {
-        var mintCookie_1 = mintCookieFactory(authTokenSyncPath);
-        index.beforeAuthStateChanged(auth, mintCookie_1, function () {
-            return mintCookie_1(auth.currentUser);
-        });
-        index.onIdTokenChanged(auth, function (user) { return mintCookie_1(user); });
+    // Only do the Cookie exchange in a secure context
+    if (authTokenSyncPath &&
+        typeof isSecureContext === 'boolean' &&
+        isSecureContext) {
+        // Don't allow urls (XSS possibility), only paths on the same domain
+        var authTokenSyncUrl = new URL(authTokenSyncPath, location.origin);
+        if (location.origin === authTokenSyncUrl.origin) {
+            var mintCookie_1 = mintCookieFactory(authTokenSyncUrl.toString());
+            index.beforeAuthStateChanged(auth, mintCookie_1, function () {
+                return mintCookie_1(auth.currentUser);
+            });
+            index.onIdTokenChanged(auth, function (user) { return mintCookie_1(user); });
+        }
     }
     var authEmulatorHost = util.getDefaultEmulatorHost('auth');
     if (authEmulatorHost) {