CODEWITHSUNDEEP
firebasefirebase-authentication
Bram Vanbilsen
Bram Vanbilsen

Reputation: 6505

Sharing user ID's as a way to find people

Is it safe to share a user's ID that Firebase creates when a new user is created? I'd like to use it as an easy way to find other people on my platform. I don't see why it should not be safe, so if it is. Please enlighten me :)

Upvotes: 1

Views: 65

Answers (1)

bojeil
bojeil

Reputation: 30838

I am not too familiar with your system or how Nintendo does this (not really a gamer) but you can build something like this:

You can display the list of users (using uid, displayName and photoURL which can be obtained using the Admin SDK or by a list you maintain in the Firebase Database, Firestore, etc) to an authenticated user. Let's say that user wants to add a connection or friend, you can get that user's ID token, the friend's uid and then add that user's uid to that authenticated user's pending connection list after you verify their ID token. On the other end, you want the other user to accept the connection request (assuming this how your people finder feature works in your app). You would show the list of pending requests. When the user accepts the request, they would send their ID token and once that's verified, you can consider the connection completed.

To summarize, you still need an ID token to confirm the user sending the request and the one confirming it. Otherwise, if you just solely rely on uids, any user can get the uid of other users and try to add them to each other's friends list, etc.

Hopefully this points you in the right direction.

Upvotes: 1

Related Questions