# CSP and Firebase

**URL:** <https://discuss.dev.twitch.com/t/csp-and-firebase/38502>\
**Category:** Extensions\
**Created:** [May 19, 2022, 10:47am UTC](https://discuss.dev.twitch.com/t/csp-and-firebase/38502 "2022-05-19T10:47:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gamifly-Vincent](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/gamifly-vincent/32/13198_2.png) [@Gamifly-Vincent](https://discuss.dev.twitch.com/u/Gamifly-Vincent)\
**Post date:** [May 19, 2022, 10:47am UTC](https://discuss.dev.twitch.com/t/csp-and-firebase/38502/1 "2022-05-19T10:47:41Z")

</div>

Hi guys,

Regarding the CSP rules:

> [@New Extensions policy for Content Security Policy (CSP) directives and timeline for enforcement](https://discuss.dev.twitch.com/t/new-extensions-policy-for-content-security-policy-csp-directives-and-timeline-for-enforcement/33695):
>
> Update (2022-01-24) In order to minimize disruption and accommodate recent Extension reviews, we have made a few updates to how and when the CSP policy will be enforced this week. The CSP enforcement date has been moved by two days to Thursday, January 27 and should begin sometime between 11am-12pm PST. If you have submitted an Extension review request before January 25 at 12pm PST, your Extension will continue to function without the new CSP enforcement until the review has been completed. W…

(the need to whitelist all the reachable domains), how can we manage to implement Firebase authentication for the users?

Firebase needs to access 2 urls that cannot fulfill the CSP policy:  
[https://securetoken.googleapis.com/v1/](https://securetoken.googleapis.com/v1/)  
[https://www.googleapis.com/identitytoolkit/v3/](https://www.googleapis.com/identitytoolkit/v3/)

Has someone managed to find a solution ?  
Thanks !