We’re writing this guide because the official guide by Google is missing a few important steps, we’ve linked in below:
Authenticate with Firebase in a Chrome extension
This will work on any operating system. For the purposes of this guide we’ll be using Mac OS
Prerequisites
- Google Chrome browser
- A Google account
- A Chrome web store developer account ($5 one time fee)
- Node.js and npm installed
Step 1: Create the Project Structure
a) Create a new directory for your project:
mkdir firebase-chrome-auth
cd firebase-chrome-auth
b) Create two subdirectories:
mkdir chrome-extension
mkdir firebase-project
Step 2: Set up the Firebase Project
a) Go to the Firebase Console.
b) Click “Add project” and follow the steps to create a new project.
c) Once created, click on “Web” to add a web app to your project.
d) Register your app with a nickname (e.g., “Chrome Extension Auth”).
e) Copy the Firebase configuration object. You’ll need this later.
const firebaseConfig = {
apiKey: "example",
authDomain: "example.firebaseapp.com",
projectId: "example",
storageBucket: "example",
messagingSenderId: "example",
appId: "example"
};
f) Navigate to the firebase-project directory
cd firebase-project
g) Initialize a new npm project
npm init -y
h) Install Firebase:
npm install firebase
i) Create an index.html file in firebase-project/index.html
Firebase Auth for Chrome Extension
Firebase Auth for Chrome Extension
j) Create a signInWithPopup.js file in firebase-project/signInWithPopup.js
import { initializeApp } from 'firebase/app';
import { getAuth, signInWithPopup, GoogleAuthProvider } from 'firebase/auth';
const firebaseConfig = {
// Your web app's Firebase configuration
// Replace with the config you copied from Firebase Console
};
const app = initializeApp(firebaseConfig);
const auth = getAuth();
// This gives you a reference to the parent frame, i.e. the offscreen document.
const PARENT_FRAME = document.location.ancestorOrigins[0];
const PROVIDER = new GoogleAuthProvider();
function sendResponse(result) {
window.parent.postMessage(JSON.stringify(result), PARENT_FRAME);
}
window.addEventListener('message', function({data}) {
if (data.initAuth) {
signInWithPopup(auth, PROVIDER)
.then(sendResponse)
.catch(sendResponse);
}
});
k) Deploy the Firebase project
npm install -g firebase-tools
firebase login
firebase init hosting
firebase deploy
Note the hosting URL provided after deployment. You’ll need this for the Chrome extension.
Step 3: Set up the Chrome Extension
a) Navigate to the chrome-extension directory
cd ../chrome-extension
b) Create a manifest.json file in chrome-extension/manifest.json
{
"manifest_version": 3,
"name": "Firebase Auth Extension",
"version": "1.0",
"description": "Chrome extension with Firebase Authentication",
"permissions": [
"identity",
"storage",
"offscreen"
],
"host_permissions": [
"https://*.firebaseapp.com/*"
],
"background": {
"service_worker": "background.js",
"type": "module"
},
"action": {
"default_popup": "popup.html"
},
"web_accessible_resources": [
{
"resources": ["offscreen.html"],
"matches": [""]
}
],
"oauth2": {
"client_id": "YOUR-ID.apps.googleusercontent.com",
"scopes": [
"openid",
"email",
"profile"
]
},
"key": "-----BEGIN PUBLIC KEY-----nYOURPUBLICKEYn-----END PUBLIC KEY-----"
}
c) Create a popup.html file in chrome-extension/popup.html
Firebase Auth Extension
Firebase Auth Extension
d) Create a popup.js file in chrome-extension/popup.js
document.addEventListener('DOMContentLoaded', function() {
const signInButton = document.getElementById('signInButton');
const signOutButton = document.getElementById('signOutButton');
const userInfo = document.getElementById('userInfo');
function updateUI(user) {
if (user) {
userInfo.textContent = `Signed in as: ${user.email}`;
signInButton.style.display = 'none';
signOutButton.style.display = 'block';
} else {
userInfo.textContent = 'Not signed in';
signInButton.style.display = 'block';
signOutButton.style.display = 'none';
}
}
chrome.storage.local.get(['user'], function(result) {
updateUI(result.user);
});
signInButton.addEventListener('click', function() {
chrome.runtime.sendMessage({action: 'signIn'}, function(response) {
if (response.user) {
updateUI(response.user);
}
});
});
signOutButton.addEventListener('click', function() {
chrome.runtime.sendMessage({action: 'signOut'}, function() {
updateUI(null);
});
});
});
e) Create a background.js file in chrome-extension/background.js
const OFFSCREEN_DOCUMENT_PATH = 'offscreen.html';
const FIREBASE_HOSTING_URL = 'https://your-project-id.web.app'; // Replace with your Firebase hosting URL
let creatingOffscreenDocument;
async function hasOffscreenDocument() {
const matchedClients = await clients.matchAll();
return matchedClients.some((client) => client.url.endsWith(OFFSCREEN_DOCUMENT_PATH));
}
async function setupOffscreenDocument() {
if (await hasOffscreenDocument()) return;
if (creatingOffscreenDocument) {
await creatingOffscreenDocument;
} else {
creatingOffscreenDocument = chrome.offscreen.createDocument({
url: OFFSCREEN_DOCUMENT_PATH,
reasons: [chrome.offscreen.Reason.DOM_SCRAPING],
justification: 'Firebase Authentication'
});
await creatingOffscreenDocument;
creatingOffscreenDocument = null;
}
}
async function getAuthFromOffscreen() {
await setupOffscreenDocument();
return new Promise((resolve, reject) => {
chrome.runtime.sendMessage({action: 'getAuth', target: 'offscreen'}, (response) => {
if (chrome.runtime.lastError) {
reject(chrome.runtime.lastError);
} else {
resolve(response);
}
});
});
}
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
if (message.action === 'signIn') {
getAuthFromOffscreen()
.then(user => {
chrome.storage.local.set({user: user}, () => {
sendResponse({user: user});
});
})
.catch(error => {
console.error('Authentication error:', error);
sendResponse({error: error.message});
});
return true; // Indicates we will send a response asynchronously
} else if (message.action === 'signOut') {
chrome.storage.local.remove('user', () => {
sendResponse();
});
return true;
}
});
f) Create an offscreen.html file in chrome-extension/offscreen.html
Offscreen Document
g) Create an offscreen.js file in _chrome-extension/offscreen.js
_
const FIREBASE_HOSTING_URL = 'https://your-project-id.web.app'; // Replace with your Firebase hosting URL
const iframe = document.createElement('iframe');
iframe.src = FIREBASE_HOSTING_URL;
document.body.appendChild(iframe);
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
if (message.action === 'getAuth' && message.target === 'offscreen') {
function handleIframeMessage({data}) {
try {
const parsedData = JSON.parse(data);
window.removeEventListener('message', handleIframeMessage);
sendResponse(parsedData.user);
} catch (e) {
console.error('Error parsing iframe message:', e);
}
}
window.addEventListener('message', handleIframeMessage);
iframe.contentWindow.postMessage({initAuth: true}, FIREBASE_HOSTING_URL);
return true; // Indicates we will send a response asynchronously
}
});
Step 4: Configure Firebase Authentication
a) In the Firebase Console, go to Authentication > Sign-in method.
b) Enable Google as a sign-in provider.
c) Add your Chrome extension’s ID to the authorized domains list:
The format is: chrome-extension://YOUR_EXTENSION_ID
You can find your extension ID in Chrome’s extension management page after loading it as an unpacked extension.
Step 5: Load and Test the Extension
a) Open Google Chrome and go to chrome://extensions/.
b) Enable “Developer mode” in the top right corner.
c) Click “Load unpacked” and select your chrome-extension directory.
d) Click on the extension icon in Chrome’s toolbar to open the popup.
e) Click the “Sign In” button and test the authentication flow.
Troubleshooting
If you encounter CORS issues, ensure your Firebase hosting URL is correctly set in both background.js and offscreen.js.
Make sure your Chrome extension’s ID is correctly added to Firebase’s authorized domains.
Check the console logs in the popup, background script, and offscreen document for any error messages.
Conclusion
You now have a Chrome extension that uses Firebase Authentication with an offscreen document to handle the sign-in process. This setup allows for secure authentication without exposing sensitive Firebase configuration details directly in the extension code.
Remember to replace placeholder values (like YOUR_EXTENSION_ID, YOUR-CLIENT-ID, YOUR_PUBLIC_KEY, and your-project-id) with your actual values before publishing your extension.
