CODEWITHSUNDEEP
firebaseauthenticationgoogle-cloud-platformfirebase-security
Iresh Dissanayaka
Iresh Dissanayaka

Reputation: 597

Firebase security rules, How to authenticate client app, not the users?

As I understand firebase security rules are for authenticating different types of users and provide authorization based on that, but what if my application doesn't need users to register at all? What if I just need to authenticate the application, not the users? What I mean by that is, I need to assure that particular firebase products are only accessed through an given application.

What I currently do to achieve that is, just make the security rules public assuming that the specific firebase sdk does the authentication stuff, but when I do that, I get the weird warning from the firebase console that security rules shouldn't be public. What am I doing wrong?

Another question, shouldn't we authenticate any application trying to access the firebase products even before starting the user authentication?

I also would like to learn how this is done generally (best practices) when developing serverless applications with firebase/google cloud platform products.

Upvotes: 0

Views: 45

Answers (1)

Doug Stevenson
Doug Stevenson

Reputation: 317760

Firebase security rules don't support authenticating apps, only users. Authentication of an app would be pretty easy to simulate by an attacker, as all you would need is the secret compiled into the app in order to fool the rule. Even if you obfuscate the secret data, it's still just public data, and someone will figure out how to use it.

Once you ship an app to the world, you should consider everything in it to be public information, no matter how hard you might think it would be to extract that information (it's not that hard, really).

Upvotes: 1

Related Questions