Firestore should not access www.google.com, only *.googleapis.com

[neelance]

We are currently rolling out a Content Security Policy. While doing so, we noticed that Firestore sometimes connects to www.google.com, specifically https://www.google.com/images/cleardot.gif. This is because this URL is hardcoded in the webchannel transport:

https://github.com/google/closure-library/blob/7c5e8ef152adf9cc814875c42ab2a0244653b69c/closure/goog/labs/net/webchannel/netutils.js#L48

It would be best if Firestore would only connect to *.googleapis.com domains.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[jbalidiong]

Hi @neelance, thanks for reaching out. Let me check what we can do for this or bring someone here that can provide more context about it. I’ll update this thread if I have any information to share.

[ehsannas]

Googlers see b/259147891

[ehsannas]

Thanks for reporting @neelance . We'll take steps to fix this.

[neelance]

Any progress on this?

[ehsannas]

Hey @neelance , since this occurs in one of our dependencies (webchannel), I have filed an issue to them to fix it. I believe it hasn't been resolved yet. But I'll follow up again. Thanks for your patience.