CODEWITHSUNDEEP
securityauthenticationgoogle-cloud-firestorenext.jstoken
Bram
Bram

Reputation: 43

How could I secure this API?

I'm building a full-stack application with Next-JS. I'm building an API that works with Firebase. I was wondering if there is a way to make this API secure.

Let me elaborate. There is an option to your account called Premium. This variable is stored in the Firestore and will determine if you have purchased a Premium membership. This will determine whether or not you have access to certain features. I will use an API to change this variable.

I had the following in mind:

  1. Have a button on the page to upgrade account.
  2. Button pressed? Call to the API with the following params: email, upgrade to. This is because the same function can also be used to downgrade an account, for example when the user doesn't pay for the upgrade.
  3. That API function changes the variable in the Firestore. It returns a status and a message.

I want to make option 2 more secure because otherwise, it would allow anyone to change the premium variable. That is obviously not what I want. Is there anything I can do about that? For example, a token system, the thing with that is that I have been thinking about that and I don't really know how to implement that and how it would work exactly.

For anyone wondering why I am using an API: I will also be creating an app, probably with react-native. The user will also be able to change their account status and interact with the API to do other stuff in that app.

Thanks for reading and responding! I hope this is at least a bit clear. If you have any questions, please comment them.

Upvotes: 0

Views: 49

Answers (1)

LeadDreamer
LeadDreamer

Reputation: 3499

I do similar things in my app. I use Cloud Functions (which operate in a secure environment) to both save settings in Security-Rules -protected tables, as well as setting Custom Claims in the users Auth profile. All authorizations are then verified in the Cloud Functions before any changes are made - You may need to "seed" some values in a protected collection/document from the Console to get the process started.

Upvotes: 1

Related Questions