CODEWITHSUNDEEP
javascriptsecurityfirebasefirebase-authentication
DrakaSAN
DrakaSAN

Reputation: 7853

Is Firebase E-mail Auth example secure?

I am trying the JS SDK of Firebase, naturally, I picked up the provided example and started to dive in.

The example code is for e-mail sign in, hosting on Firebase.

What surprise me is that all password-compliance is made client-side:

...
    function toggleSignIn() {
      if (firebase.auth().currentUser) {
        // [START signout]
        firebase.auth().signOut();
        // [END signout]
      } else {
        var email = document.getElementById('email').value;
        var password = document.getElementById('password').value;
        if (email.length < 4) {
          alert('Please enter an email address.');
          return;
        }
        if (password.length < 4) {
          alert('Please enter a password.');
          return;
        }
...

What mecanism prevent someone from opening the code in the console, removing the check, and registering under a empty string as e-mail/password?

Searching for firebase security only tell me that everything is made in HTTPS, and that server-side rules are customizable to prevent anyone not signed in from editing the DB, but what about this?

Upvotes: 2

Views: 647

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598740

The sample code you link to is from the documentation of the Firebase email+password authentication provider. I recommend reading the documentation page too, instead of just the sample code in isolation.

When I try to create a user with a short password (123), the Firebase Authentication server responds with:

{code: "auth/weak-password", message: "The password must be 6 characters long or more."}

As you can see, the server validates the strength of the password too.

It is quite common to perform validations both client and server side.

  • Validations must be performed on the server to ensure that they can't be hacked around, as you said.
  • By also validating the values client-side, you can ensure a better user experience. In this example: you can prevent the need for a round-trip to the server in case the user enters an invalid email address.

Upvotes: 4

Related Questions