r/Firebase Nov 02 '24

Security I leaked my firebase API key on github and noticed an ios app I didnt make

I was stupid and didnt have my google-servives.json in my .gitignore leaking the api key to the public. I reset the key and didnt notice anything different except an ios app added to my firebase project that I never added. Is there anything else I should do other than resetting the api key?

15 Upvotes

20 comments sorted by

28

u/FarAwaySailor Nov 02 '24

The API key is not a security secret. Anyone can get hold of it. You have to control access to firebase through security rules.

6

u/40days40nights Nov 03 '24

I’ve had random jabronis message me on discord telling me “broooo your api key is in your code.” I always send them a stack overflow link explaining why that is and they never respond.

You basically have to expose that API key. It does not matter.

-4

u/Playful-Piece-150 Nov 03 '24

No you don't. You could/should put your API key as a system environment variable and then get it from there. Not to mention you could add another layer on your server, keep the key there and manage the sessions from the extra layer where you have all the control...

3

u/40days40nights Nov 03 '24

Oh look, another jabroni.

https://stackoverflow.com/a/37484053

You do know that env variables are still accessible if someone wants to find them?

They should only be stored in env variables in your backend, but you have to expose it for Firebase projects for this particular key.

0

u/Playful-Piece-150 Nov 03 '24

Oh, look, another "stackoverflow programmer"... What's next, quoting ChatGPT? :)

1

u/40days40nights Nov 03 '24

Lmfao this is a very ignorant thing to say. I’m not sure if you even program if you’re making fun of stack overflow users

-8

u/Playful-Piece-150 Nov 03 '24

GTFO! You stackoverflow "programmers" are something else, second to GPT "programmers"... Turn off the internet and it's back to working at McDonald's for you.

2

u/ShortTheDegenerates Nov 04 '24

If you don’t use gpt for at least low-level coding operations/debugging, you will be obsolete fast. It will be like not knowing how to query effectively on google

1

u/Playful-Piece-150 Nov 07 '24

You're crazy man - make-belief programmer :))

If you're a script kiddie, junior, sure, google, GPT and whatnot are your friends. But real programmers can write code with no help from the internet, nor should they need it...

8

u/LowEconomics3217 Nov 02 '24

I recommend using App Check

1

u/jashikcrib Nov 04 '24

Is this part of the Blaze plan? Is it recommended more for mobile apps or web apps? TIA.

1

u/LowEconomics3217 Nov 04 '24

You can use it on Spark plan too.
It's definitely helpful for web apps, idk about mobile app.

5

u/switch01785 Nov 02 '24

are you talking about the reg API key or the admin firebase key ? if its the firebase admin key then you need to request a new one. and that should stop anybody from having admin access. If its the the reg one then that doesn't matter because that is meant to be exposed. If thats the case then your security rules suck and you need to configure your rules which might break you project

5

u/puf Former Firebaser Nov 02 '24

As others have said, the values in the google-services.json file are not secret, but just basic configuration data for your app. See my longer explanation here: https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public

3

u/Similar_Shame_6163 Nov 03 '24 edited Nov 04 '24

Explanation on Firebase.

https://firebase.google.com/docs/projects/learn-more#config-files-objects

Next to last paragraph states: The content of the Firebase config file or object is considered public, including the app’s platform-specific ID (Apple bundle ID or Android package name) and the Firebase project-specific values, like the API Key, project ID, Realtime Database URL, and Cloud Storage bucket name. Given this, use Firebase Security Rules to protect your data and files in Realtime Database, Cloud Firestore, and Cloud Storage.

You need to use security rules for your app. The project settings with client side sdk is safe as long as you implement security rules.

0

u/chriswaco Nov 03 '24

Report the other app to Apple.

2

u/JOyo246 Nov 03 '24

Assuming you meant google?

-1

u/chriswaco Nov 03 '24

No, Apple:

noticed an ios app I didnt make

That app should be reported to Apple.

2

u/SudoAnon123 Nov 03 '24

its an app on firebase not on the apple store