More complex check for authTokenSyncUrl

[jamesdaniels]

• Don't allow insecure context, unless localhost
• Protect against escaping hacks by instantiating a new URL instance

b/327386166

FYI @hsubox76

Q, should we guard against isSecureContext not being available? Can I use isSecureContext?

[changeset-bot]

🦋 Changeset detected

Latest commit: 939a060

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@firebase/auth	Patch
@firebase/auth-compat	Patch
firebase	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Changeset File Check ✅

• No modified packages are missing from the changeset file.
• No changeset formatting errors detected.

[google-oss-bot]

Size Report ¹

Affected Products

• @firebase/auth

  Type	Base (1eb302f)	Merge (a074812)	Diff
  browser	177 kB	178 kB	+137 B (+0.1%)
  esm5	231 kB	231 kB	+135 B (+0.1%)
  module	177 kB	178 kB	+137 B (+0.1%)

• @firebase/auth/internal

  Type	Base (1eb302f)	Merge (a074812)	Diff
  browser	188 kB	188 kB	+137 B (+0.1%)
  esm5	244 kB	245 kB	+135 B (+0.1%)
  module	188 kB	188 kB	+137 B (+0.1%)

• bundle

  Type	Base (1eb302f)	Merge (a074812)	Diff
  auth (GoogleFBTwitterGitHubPopup)	101 kB	101 kB	+108 B (+0.1%)

• firebase

  Type	Base (1eb302f)	Merge (a074812)	Diff
  firebase-auth.js	147 kB	148 kB	+107 B (+0.1%)

Test Logs

• Base (1eb302f): https://github.com/firebase/firebase-js-sdk/actions/runs/8282563628
• Merge (a074812): https://github.com/firebase/firebase-js-sdk/actions/runs/8378887760

1. https://storage.googleapis.com/firebase-sdk-metric-reports/L76Ue7M1uP.html

[google-oss-bot]

Size Analysis Report ¹

Affected Products

• @firebase/auth

  • getAuth

    Size

    Type	Base (1eb302f)	Merge (a074812)	Diff
    size	72.4 kB	72.5 kB	+108 B (+0.1%)
    size-with-ext-deps	100 kB	100 kB	+108 B (+0.1%)

Test Logs

• Base (1eb302f): https://github.com/firebase/firebase-js-sdk/actions/runs/8282563628
• Merge (a074812): https://github.com/firebase/firebase-js-sdk/actions/runs/8378887760

1. https://storage.googleapis.com/firebase-sdk-metric-reports/MhgL2oQFiE.html

[hsubox76]

Q, should we guard against isSecureContext not being available? Can I use isSecureContext?

I think we should. Sure, this is the browser bundle and it should never be run in Node, and the chart seems to cover all the browsers we support but I'm never sure about extensions, iframes, jsdom, and bad SSR configs where they end up pulling in the browser bundle in Node.