[Auth] Restrict the ':' character in API key (#4706)

* Restrict the ':' character in API key

* Formatting

* Add domain test as well

* Formatting

Author: sam-gc

packages-exp/auth-exp/src/core/auth/register.ts

@@ -59,7 +59,15 @@ export function registerAuth(clientPlatform: ClientPlatform): void {
         const app = container.getProvider('app-exp').getImmediate()!;
         const { apiKey, authDomain } = app.options;
         return (app => {
-          _assert(apiKey, AuthErrorCode.INVALID_API_KEY, { appName: app.name });
+          _assert(
+            apiKey && !apiKey.includes(':'),
+            AuthErrorCode.INVALID_API_KEY,
+            { appName: app.name }
+          );
+          // Auth domain is optional if IdP sign in isn't being used
+          _assert(!authDomain?.includes(':'), AuthErrorCode.ARGUMENT_ERROR, {
+            appName: app.name
+          });
           const config: ConfigInternal = {
             apiKey,
             authDomain,