CODEWITHSUNDEEP
firebaseflutterfirebase-cloud-messaging
Miguel Oliveira
Miguel Oliveira

Reputation: 33

Do I need to protect my firebase Server Key? Can I store it in the source code or is there a way to get it programatically?

Right now I have my Server Key for Firebase messaging hardcoded in my code.

Is this a security problem for when I deploy my app?

Can I get this key programatically?

Upvotes: 1

Views: 753

Answers (2)

flutroid
flutroid

Reputation: 1396

Yes it's a security issue, According to this official document at the bottom says.

Important: Do not include the server key anywhere in your client code. Also, make sure to use only server keys to authorize your app server. Android, iOS, and browser keys are rejected by FCM.

And I don't think "get this key programmatically" is good idea because you still downloaded key to the client, or using other way to store in the client.

Upvotes: 2

greywolf82
greywolf82

Reputation: 22173

There's no way to protect in a serious way the key in your apk. Getting the key would be quite easy, so you have a big security issue and your poor security design could have bad conseguences, see for example what GDPR says about privacy. Remove the key, change it if possible and implement a server to communicate with your clients and send push messages.

Upvotes: 0

Related Questions