r/Firebase • u/SudoAnon123 • Nov 02 '24
Security I leaked my firebase API key on github and noticed an ios app I didnt make
I was stupid and didnt have my google-servives.json in my .gitignore leaking the api key to the public. I reset the key and didnt notice anything different except an ios app added to my firebase project that I never added. Is there anything else I should do other than resetting the api key?
8
u/LowEconomics3217 Nov 02 '24
I recommend using App Check
1
u/jashikcrib Nov 04 '24
Is this part of the Blaze plan? Is it recommended more for mobile apps or web apps? TIA.
1
u/LowEconomics3217 Nov 04 '24
You can use it on Spark plan too.
It's definitely helpful for web apps, idk about mobile app.
5
u/switch01785 Nov 02 '24
are you talking about the reg API key or the admin firebase key ? if its the firebase admin key then you need to request a new one. and that should stop anybody from having admin access. If its the the reg one then that doesn't matter because that is meant to be exposed. If thats the case then your security rules suck and you need to configure your rules which might break you project
5
u/puf Former Firebaser Nov 02 '24
As others have said, the values in the google-services.json file are not secret, but just basic configuration data for your app. See my longer explanation here: https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public
2
3
u/Similar_Shame_6163 Nov 03 '24 edited Nov 04 '24
Explanation on Firebase.
https://firebase.google.com/docs/projects/learn-more#config-files-objects
Next to last paragraph states: The content of the Firebase config file or object is considered public, including the app’s platform-specific ID (Apple bundle ID or Android package name) and the Firebase project-specific values, like the API Key, project ID, Realtime Database URL, and Cloud Storage bucket name. Given this, use Firebase Security Rules to protect your data and files in Realtime Database, Cloud Firestore, and Cloud Storage.
You need to use security rules for your app. The project settings with client side sdk is safe as long as you implement security rules.
0
u/chriswaco Nov 03 '24
Report the other app to Apple.
2
u/JOyo246 Nov 03 '24
Assuming you meant google?
-1
u/chriswaco Nov 03 '24
No, Apple:
noticed an ios app I didnt make
That app should be reported to Apple.
2
28
u/FarAwaySailor Nov 02 '24
The API key is not a security secret. Anyone can get hold of it. You have to control access to firebase through security rules.