[alpha][auth][bug?] signInWithPopup triggers fetch of project config -> blocks popup

[robhogan]

Raising this as discussion initially since I'm not 100% sure this is unique to alpha, but that's where I'm seeing it.

Environment

• Operating System version: macOS Big Sur (11.2)
• Browser version: Safari (mac, desktop, not private) 14.0.3 (16610.4.3.1.4)
• Firebase SDK version: 0.0.900-exp.1b15844a1
• Firebase Product: auth (Google sign-in)

Problem (and solution?)

I'm getting auth/popup-blocked errors using signInWithPopup with GoogleAuthProvider on Safari (mac desktop, not private) and I've traced it down to this:

firebase-js-sdk/packages-exp/auth-exp/src/platform_browser/popup_redirect.ts

Line 91 in e8811c0

await this.originValidation(auth);

The first time originValidation is called it fetches project config with an API call (identitytoolkit, GET v1/projects) - apparently for no other reason than to throw with a helpful message if origins are improperly configured.

The delay caused by this fetch, which is before the popup is opened, causes the popup to become disassociated from the user interaction that triggered it. This causes the popup to be blocked by Safari and quite possibly others. Ideally there should be no asynchronous operations between user "click" and popup opening.

There doesn't seem to be any public API to pre-warm this project config or skip domain validation (which seems sensible in production anyway). Commenting out that line fixes the issue with no ill effects I can see.

[Feiyang1]

@samhorlbeck any thought?

[sam-gc]

Woops, sorry I missed this mention. I believe it's fine to run this check asynchronously but I need to check with some other folks. This comment in the Closure SDK makes me think it will be fine to run this check in the background.

[sam-gc]

I've opened up this PR to address this: #4514

[sam-gc]

The PR is merged and should be included in the next release! Please let us know if you're still seeing issues on Safari after updating. Thanks again for the report!

[robhogan]

Thanks @samhorlbeck, will do 👍