The key to Firebase security - Google I/O 2016
Why Stack Overflow recommends it
Stack Overflow users link it as the go-to introduction to Firebase Realtime Database security rules, especially when answering questions about auth checks, validation, and why client-side config keys are safe to expose.
Recommended by 14 people across 15 different months, 2016 to 2022.
What it is
A Google I/O 2016 talk from the Firebase team on Firebase Security Rules, covering how to declaratively control who can read and write data and how to validate its schema. It is a 44-minute deep dive into best practices for securing production Firebase apps.
What people said
Strong rec Frank van Puffelen · 2016-07 · Stack Overflow · on “firebase .indexOn warning with autoId”
The $ just means that whatever rules you have under there apply to *each* child node. Within that section you can then use `$commentId` to refer to the matched node. To learn all about security rules, I highly recommend the key to Firebase security [this video] (video) from I/O
Strong rec niraj · 2016-08 · Stack Overflow · on “Firebase database authentication with email & password”
There is no users node so, defining in rules would not help. I think the rule that may work would be something like below (assuming 0 and 1 are uid): { "rules": { "Action_helper":{ "$uid":{ //user-based security ".read": "auth != null && $uid === auth.uid", ".write": "auth != null", }//$uid }//Action_helper }// rules } Examining above rules by default if we do not define rules then it is false i.e. at Action_helper it is false for both read and write. When it comes to the node uid (where $ denotes wild card) then, we check if the user id of logged in user is same to uid of this node and define rules accordingly. I highly recommend to go through the link The key to Firebase security - Google
Recommends devprashant · 2016-05 · Stack Overflow · on “How can I allow users to create private data in Firebase for Android?”
Also see this great video session presented in google io may 2016 titled "The key to firebase security" [this video]
Recommends André Kool · 2016-07 · Stack Overflow · on “Firebase storage - Limit size of image that users upload to firebase storage”
You could limit the file size in firebase storage itself using the security rules. check out this site [LINK] or the second part of this video [this video]
Recommends Mike McDonald · 2016-08 · Stack Overflow · on “Can somebody get Firebase credentials from my apk and use them?”
We don't ship the Realtime Database secret (or any other "secret" material) in the json file that gets baked into your app. That file simply contains resource identifiers that allow us to know which resources (database, storage bucket, analytics, etc.) to properly authenticate to (we use Firebase Authentication [LINK] for these purposes), and we handle server side authorization to ensure that users are properly logged in. If you are authorizing your requests properly (using Firebase Realtime Database Rules [LINK] , for instance), your data is secure! I'd recommend watching The Key to Firebase Security [this video] , one of our I/O talks, which talks in greater detail about how this works.
Recommends Neelavar · 2016-10 · Stack Overflow · on “How to hide things (API keys, etc) from Chrome Remote Debugging in Ionic app?”
For Firebase access, it is meant to use the API keys on the client side. That is the way to enable clients to access the Firebase (not just database only). Having said that 'Security' is still the question and to address that Firebase provides (here database access) - database rules. Best practice is to secure the real-time database at Firebase using database rules and enable clients to use the API key. Firebase Database Security Rules [LINK] Very interesting video [this video] about Firebase Security at Google I/O
Recommends Tommie C. · 2016-11 · Stack Overflow · on “Firebase rules user creation denied, possible multiple .read/.write rule?”
Caveat: I haven't done this before but I've just finished checking out the video [LINK] on rules. Create a metadata underneath your User structure so that you store hidden data in that area. If you need to break out some of the metadata for public use just change that key or better yet put the public data under the User object and totally restrict read/write access to the metadata. Revised data structure should be something along these lines: /Users/$uid (wildcard) / metadata / hiddenKeyForValue Then in your rules create something like: { "rules": { "Users": { "$uid": { "publicMetadata": { ".read" : "auth !== null", ".write" : "auth !== null" } "metadata" : { ".read" : $uid === auth.uid , ".
Recommends Lirianer · 2016-12 · Stack Overflow · on “Fetch database data from firebase to my blog without auth”
I would recommend you get familiar with Firebase Database Security Rules [LINK] . These are the ones which dictate who can read/write into the Firebase Database. All new projects starts with the rules { rules: { .read: auth != null, .write: auth != null } } This means anyone who isn't authenticated won't be able to read or write in our database. To achieve what you might need without compromising other data you may do something like the following: { rules: { .read: auth != null, .write: auth != null blogEntries: { .read: true, .write: auth != null } } } By doing this you are allowing everyone to read the data inside blogEntries, and this means ALL the data inside, while if someone wants to w
Recommends Pado · 2017-06 · Stack Overflow · on “How do I enable secure user data access using Firebase without requiring user to login”
Anonymous log-in just provide authentication, that means you can associate a Unique ID to each of your user. This de facto create a user ID and a Auth Token that is persisted in the phone between runs of your app. Token is refreshed when you call signInAnonymously() . Check this link [LINK] for hits on how to handle anonymous logins. Talking about security, anonymous login is not a bad practice. Obviously if you want to keep your DB safe you have to write custom access rules: e.g. you probably want "anon_user322" to read your page content, but definitely not to modify or delete it. Achieving this is not so hard, you have just to go to your FirebaseConsole [LINK] and write your own rules for
Recommends john-raymon · 2017-08 · Stack Overflow · on “Is there anyway to secure API keys in React JS, even though it's on the client side?”
just stumbled upon this video [this video] , which explains why exposing that fire config object doesn't make your app vulnerable.. this speaks on the authorizations rules capabilities firebase currently obtains which enhances security when it comes to the firebase storage product and the firebase real time database product, which both rely on the firebase authentication service in order to make the firebase authorization security rules useful .. thanks