title: Difference between firebaseio.com and firebaseapp.com
body: <p>My Firebase web app is communicating with two urls that are relevant for this question:</p>
  
  <ul>
  <li>https://*.firebaseapp.com/ (1st URL)</li>
  <li>https://*.firebaseio.com/  (2nd URL)</li>
  </ul>
  
  <p>For security reasons outside of scope of the Firebase service, I'm putting CSP headers in my app (content=frame-src). </p>
  
  <p>I whitelisted <code>https://[MY_ID].firebaseapp.com/</code> (1st URL), because it is needed for authentication. Moreover, the same url is in my config in my frontend, so I feel it's safe to have it there and not exposing any secrets (if that makes sense...). </p>
  
  <p>But while testing my app, every once in a while I get the following error about the 2nd URL:</p>
  
  <blockquote>
    <p>Refused to frame '<a href="https://[OTHER_ID].firebaseio.com/" rel="nofollow noreferrer">https://[OTHER_ID].firebaseio.com/</a>' because it
    violates the following Content Security Policy directive:
    "[MY_CSP_DIRECTIVE]".</p>
  </blockquote>
  
  <p>My questions are:</p>
  
  <p>In General:</p>
  
  <ul>
  <li>What is the purpose of this url? I don't seem to miss any functionality so far while I get this error message in my console.</li>
  </ul>
  
  <p>Actions:</p>
  
  <ul>
  <li>Is it safe to whitelist <code>https://*.firebaseio.com/</code> with a wildcard? Or does that open up communication to random backends of other (possibly malicious) Firebase users? </li>
  <li>Should I specify my ID like <code>https://[OTHER_ID].firebaseio.com/</code> instead? Or am I then exposing an ID that I shouldn't expose in any way?</li>
  <li>Or should I ignore the error as long as it doesn't seem to affect my app?</li>
  </ul>