Firebase signInWithRedirect fails on the deployed domain

What it means in plain English

Redirect sign-in depends on a helper hosted on your Firebase domain. Firebase's redirect guide says the JavaScript SDK uses a cross-origin iframe to that domain, and that this does not work in browsers that block third-party storage. Chrome has required one of the documented setups since June 24, 2024. Firefox and Safari already did.

If the app is hosted on a subdomain of firebaseapp.com, Firebase says you are not affected. A Vercel, Netlify, or custom domain is.

Likely causes

• The AI used signInWithRedirect() and the app is not hosted by Firebase.
• The app is on Firebase Hosting with a custom domain or a web.app subdomain, and authDomain is still the default firebaseapp.com host.
• The OAuth provider was never given the new redirect URI.

How to fix it, step by step

1. If you can use a popup, switch to signInWithPopup() and read the user from that call. Firebase shows this as option 2 and says the rest of the app stays the same. Popups can be blocked, especially on phones. If that is a problem, use one of the other options.
2. On Firebase Hosting with a custom domain, set authDomain to the domain that serves the app. Firebase says not to change the other fields in the config object. Add https://<that-domain>/__/auth/handler to the OAuth provider's authorized redirect URIs. The trailing /__/auth/handler is required. Keep continue_uri on the authorized-domain list, then redeploy so /__/firebase/init.json is current.
3. If the app is not on Firebase Hosting, Firebase says to use the popup option, a reverse proxy of /__/auth/ to <project>.firebaseapp.com (not a 302), self-hosted helper files, or your own provider sign-in plus signInWithCredential(). Self-hosting the helper does not work for Apple or SAML.

How to check it worked

• A redirect or popup sign-in from the deployed origin returns a user.
• The provider's redirect URI list includes the authDomain you configured.

Sources

• https://firebase.google.com/docs/auth/web/redirect-best-practices (opens in a new tab)