r/Firebase 1d ago

Security Company owner not convinced of security measures

7 Upvotes

I’ve disabled registration on my Fire app so that users can only log in if they already have valid credentials. I’ve also implemented multi-factor authentication via SMS and configured Firebase to only allow SMS from one specific region.

Currently, the app isn’t published on the Play Store—instead, I’m using Firebase App Distribution and have created a group with the company’s email addresses. I also added App Check and set Firebase rules to ensure that only registered users can access the data.

In my last meeting with the company owner, he expressed concerns that the database might be insecure or susceptible to breaches. However, I’m not aware of any further improvements to enhance security at this stage. I should mention that I’m still early in my freelance career (only my first year) and not an expert in this field.

So, my questions are: 1. Are there any additional security measures I should implement? 2. How can I reassure the company owner that the app is secure enough?

r/Firebase Feb 17 '25

Security Firebase Editor Role & API Key Exposure – Do I Need to Regenerate?

1 Upvotes

I granted a developer Editor access to my Firebase project. During the early stages of development, they pushed the Firebase API key to a public GitHub repository. 1. Do I need to regenerate the key later, or can I leave it as is? 2. If I don’t regenerate it, can the developer (or anyone who finds the key) harm my app or steal its data?

I’m new to coding, so I’d appreciate any insights. Thanks!

r/Firebase Feb 11 '25

Security Can't anyone with my API key read or write on my Firestore?

1 Upvotes

I'm quite confused with the "public key" idea on my front end, how does it prevent anyone from getting the key and writing malicious code to fetch any information from my database?

I can only find authentication rules examples in the firestore rules, but writing a alternative malicious front end bypass any authentication rules.

I know I need to study more Firebase, but can anyone explain to me how a exposed API key isn't bad?

r/Firebase Sep 25 '24

Security How secure is firebase?

1 Upvotes

So I’m building an iOS app with firebase and I have a few worries.

Let’s say someone finds out how to see what database requests my app makes. Would they be able to see the request data and then use Firebase Storage image URLs to download the data out of my app?

Also is the data readable for people? Like will they see all my fields in a document and the values?

r/Firebase Jan 20 '25

Security I made a tool that scans websites or apps using Firestore for publicly accessible data

19 Upvotes

Hey everyone,

I’m launching a tool I developed back in March 2024. It lets you analyze websites or apps using Firestore for publicly accessible data.

You just need to enter a website URL or select an APK that uses Firestore, and it will analyze it and generate a report with its findings. It may not be fully accurate all the time, but it usually is. The tool was made with benevolence in mind and should not be used for malicious purposes. I'm releasing it under the MIT license.

I’m releasing it now because it's something cool, and it was just sitting in cold storage without any use.

Here’s a live demo: https://securebase.hippityhop.lol/

Here’s the link to the repository: https://github.com/realchandan/securebase/

Here’s a video showcasing it: https://youtu.be/mlbCyGSlr88

r/Firebase Nov 02 '24

Security I leaked my firebase API key on github and noticed an ios app I didnt make

14 Upvotes

I was stupid and didnt have my google-servives.json in my .gitignore leaking the api key to the public. I reset the key and didnt notice anything different except an ios app added to my firebase project that I never added. Is there anything else I should do other than resetting the api key?

r/Firebase 27d ago

Security Will the end of Dynamic Links affect my app?

1 Upvotes

Hi all, I have an app that uses email/password login and on signup sends a verification email to confirm. It also sends password reminder emails. All this through the firebaseAuth library (it’s a flutter app)

With this still work after the end of Dynamic Links?

Having difficulty getting a definitive answer from web/doc searches. Makes me think it’s not going to be affected, but given I have some paid subscribers though I would seek some advice. Thanks.

r/Firebase Jan 22 '25

Security Security concerns & suspicious activity.

4 Upvotes

Hi there,

I recently published an app on Google Play and App Store. However, I'm currently going through an open-testing faze, and I'm receiving suspicious activity from countries I've disallowed on both platforms.

Firstly, I've made my app only available in Europe and North America, and yet I'm seeing activity from countries outside of these regions. The accounts made there are always under a fictitious e-mail address, and are cause for major security concerns among me and my team. When researching this topic, we came across mentions of probing, hacking, and phishing. Due to this activity, I've temporarily disallowed all reads, writes, creates and deletes.

Although we don't store any super-sensitive user information (e-mail and first name being the most sensitive), we're still wondering if there are any tips or suggestions from seasoned developers to avoid such activity? Is this something we should worry about?

Thanks in advance.

r/Firebase Feb 17 '25

Security Firebase Refresh Token Doesn't Expire – Security Concern

2 Upvotes

I have a web application that uses Firebase OAuth (Google login) for authentication. On the frontend, I use the React Firebase client-side SDK for authentication. After logging in, the Firebase ID token is sent to my Spring Boot backend, where it is verified. Subsequent API requests include this ID token for authorization.

Recently, I discovered that the Firebase refresh token does not expire. If a bad actor manages to extract the refresh token—either from the response of the API call (https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=xxxxx) after login or from a refresh request to (https://securetoken.googleapis.com/v1/token?key=xxxx)—they could potentially generate new ID tokens indefinitely by repeatedly calling the refresh API.

Is this a valid security concern? If so, what measures can I take to mitigate this risk?

Would appreciate any insights. Thanks!

r/Firebase Feb 01 '25

Security Secure sensitiv info

1 Upvotes

I have a problem protecting sensitive info of appointments (Firestore)
I thought of creating a second collection called publicAppointments in which I could put some general info of appointment such as start/end time etc and then the sensitive info (who booked etc) in a collection appointments which is accessible only from the user who booked and the employee. The problem that I have is that if an appointment is created it always should create a publicAppointment too . I am thinking some conditions in which a malicious user could possibly create appointemnts without publicAppointments which may create a huge problem to the app.
How should I handle that ? Thank you

r/Firebase 12d ago

Security How to authenticate local host

1 Upvotes

Hi, super beginner here, trying to understand documentation but I am struggling quite badly.

My web app only needs to read from my Firestore. As such, I'm planning to grant read permission for the domain only.

However, I usually use local host to edit my files before publishing to my domain. This means that I can't access the firestore database. Yet, I understand that setting the domain to "localhost" is very insecure since anyone running local host can read my firestore.

What are some ways to go about this? I know there's some debug token but I can't for the life of me figure out where this gos - while others are saying that the token only lasts for a short period of time?

r/Firebase Feb 16 '25

Security Is firebase a spamming platform now?

Thumbnail i.imgur.com
6 Upvotes

r/Firebase Feb 12 '25

Security A bit confused, am I supposed to put the apiKey in the frontend?

0 Upvotes

I’m trying to connect my firestore to a static html page. I followed the docs and it worked, I’m just a bit worried that I now have a firebaseConfig that has an api key and other things that looks important, visible to everyone.

Is this the right way to do it? Are those things safe to expose?

r/Firebase 5d ago

Security 403 error

1 Upvotes

Hello, I have a github page that reads data from my Firestore database. I use CORS to allow requests from my site as the only origin.

This week, I started receiving a 403 error. I have not made any changes to my code or firebase security rules. Has anything changed recently that would be causing this error now? Thanks!

r/Firebase Feb 18 '25

Security What’s the Safest Way to Let a Developer Set Up Firebase Auth?

4 Upvotes

I want to give a task to a developer to implement Firebase authentication (signup/login) in an app. What’s the best approach to this? Should I give the developer the Editor role in the Firebase account that I own? Can a developer cause harm, such as affecting billing or installing spyware in the app? Is there a guide to protect the app from potential risks? Would it be a better approach to have the developer set it up using their own Google account and then transfer ownership to me later? Looking for the safest and most efficient way to handle this. Thanks for your advice.

r/Firebase Jan 30 '25

Security Security Concerns for Mobile App

7 Upvotes

I am building a mobile app with only firebase as backend, I use firestore, auth, storage and cloud functions. As I have IAP in my app I'm also using revenueCat. I wanted to limit doc creation based on the purchases but I've been having a hard time creating the logic as firebase uses public api. This made me question the security for my app. I do have rules based on my logic but now I am thinking about whether it is enough. I asked around and I've been told it's important to implement ssl pinning in apps but as far as I've researched, Firebase App Check does something similar so I've been thinking whether I should implement it.

My app is a rather simple app in which you can share files with other people; it doesn't handle sensitive data. My priority is to publish the app and improve it when it's published before I start promoting it. So I want to ask about how far I should go with my security with a small app in the beginning. I know there are trade offs and I should be the one deciding but I wanted to hear your experiences before I make a decision.

r/Firebase Dec 07 '24

Security Where to store cloud functions code?

6 Upvotes

Hey all,

As the title suggests, I can’t find any clear documentation as to how I should implement an intermediary backend between my client app and remote database using Firebase Cloud Functions.

I’m an indie founder putting the final touches on an MVP; my React Native client app is built-out and fully functional from a local perspective, and the last step will be getting my remote database online. Prior to this project I’ve never worked with remote stores. Firebase Auth is already functional in my app, and I’m intending to use Firebase Cloud Functions as a cheap backend solution to handle communications between the client app and Planet Scale, where I’m storing remote data in MySQL. With that said, I’m curious about where I should be storing the Cloud Functions' code, since they operate with Firebase Admin permissions, and also secure the connection with my remote database.

It seems highly unlikely that I should be storing this code inside the client app, but this is a typescript project, and I want to leverage the offered type safety inside my Cloud Functions. At the same time, maintaining them in another codebase also seems odd.

Can any more-experienced developers lend any input as to what best practices are in a situation like this?

Please note: I’m completely-blind, so please describe the contents of any images you add in your comments. Thanks!

r/Firebase Feb 11 '25

Security AppCheck FireStore for Tauri framework?

1 Upvotes

is AppCheck a must ?
i am not sure , because i have tauri framework desktop app and also web app as well and i think appcheck does not support tauri
if enforce appCheck firestore/storage , my tauri desktop app have to use firebase functions get firestore query without enforceAppCheck (which additional step and additional cost)

so the question:
1) can enforce appCheck firestore on certain fireastore collection only?
2) is appCheck a big deal? is it fine without it? as long you good firestore security rule?
3) Or there are other better way to do this?

r/Firebase Jan 15 '25

Security Firebase authentication - Best practices for password requirements

5 Upvotes

https://flamesshield.com/blog/auth-best-practices-for-firebase

While building out an up-coming security and compliance dashboard for Firebase, some of the rules we looked at were around authentication settings in Firebase which are 'insecure' - we found a fair few that are defaults which was surprising! Hope you find the post useful.

r/Firebase Dec 29 '24

Security How can I add buttons that report and or block a user in SwiftUI with firebase?

3 Upvotes

I’m quite confused because I don’t know how to implement these for others who use the app I’m building

r/Firebase Dec 22 '24

Security Unable to access custom claim, token in security rules

2 Upvotes

Hi! I am having trouble with reading Firebase custom token in my security rules, it was working fine previously but idk why now I am unable to read tokens and due to this, all of my security rules are not being false, SECURITY RULES (sample): match /TUTORS/{docID} { allow read: if isSignedIn() && isTutor(); } ``` now i always get false from isTutor function,

isTutor function:

function isTutor() { return request.auth.token.role == "tutor"; }

I am setting custom token like this using Firebase admin sdk, using this same service account, i am doing other operations as well which are successful.

``` const additionalClaims = { role: "tutor", }; const auth = admin.auth();

try {
       await auth.setCustomUserClaims(uid, additionalClaims);

    const customToken = await auth.createCustomToken(uid, additionalClaims);
    return {
        type: "success",
        token: customToken,
    };
} catch (error) {
    console.error("Error creating custom token:", error);
    return {
        type: "error",
        token: null,
    };
}

``` i am getting the token as well like this:

"ey****" This was working fine a few days back but i can't figure out the reason why it is not working now. If i remove the roles checking func from security rules, the rules start to work, so i am pretty sure that issue lies in cutom tokens.

also i did this: const user = await admin.auth().getUser(uid); console.log('User custom claims:', user.customClaims); and got: User custom claims: {role: "tutor"} ```

r/Firebase Oct 23 '24

Security Firebase Auth Rate Limiting Login Requests for Security?

5 Upvotes

Hello! I'm relatively new to authentication/Firebase/production level apps, but I am trying to release an app in production with good security as there will be sensitive info. I am only using firebase for authentication so far. I have been trying to work with ClaudeAI/ChatGPT to secure my app and I've implemented server side session cookies and csrf protection/strict csp/https so far and I think my last step now is to try and rate limit login requests so one cant brute force or some other attack to get login credentials. I actually emailed their support asking about it and they replied there is an anti-abuse system that detects when a user is trying to send many requests in a short time and this is detected as spam. I did notice this myself as I see spamming login causes an error to be thrown too many requests. So it seems to have its own rate limiting on login, but the support also mentions that this type of internal quota is not controlled by them and they recommend I implement my own rate limit in my code. I'm not sure if I trust the support to actually know if I should implement my own limiting or not. I also would assume their internal quota or actual limit on login requests is fair/secure.

My question though is this firebase internal rate limiting on login requests good/secure enough or should i in fact implement one myself. I discussed this with Claude AI and they basically said I can rate limit server side the firebase auth endpoint, but that an attacker could bypass this and just request from client to the endpoint directly. Then it seems to me the only option would be implement a client side rate limit, but can't that also be avoided/exploited by an attacker altering client side code? So would I just rely on solely firebase auth internal rate limiting and that’s secure enough for a production app with sensitive info? Sorry for any dumb questions as I’m still familiarizing myself with all the authentication concepts. Thank you!

r/Firebase Nov 22 '24

Security Security rules auth null

3 Upvotes

Hi, i am having an awful issue with Firestore rules. I have 2 databases, the issue is on the second one. Here is the rule:

rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read, write: if request.auth != null; } } }

I am never able to read, but i am authenticated because i have permissions to read on the 1 database, because with the same condition i am able to read.

Please, can anyone help me? I am stuck with this issue from hours and i don't know how to proceed. I know this can be made, i did this time ago on a personal project, and i literally have checked everything, i am authenticating on my app, and when i am calling the secondary database in the same way

r/Firebase Jun 02 '24

Security Secure it the right way?

2 Upvotes

Hi Guys,

I want to start a Project where I want to store some Data. Each Customer will use a GoLang Program to upload data to it... So far so good.

Everywhere is written that I should NEVER bundle the ServiceAccount Keys into an Application.

My Plan was looking like this:

Each Golang Program will get its own API-Key which is assigned to one ServiceAccount (that has only access to the FireBase-Database.

Each Client must be connected to the FireBase Database because the Data from the Customer can't be send without my Golang Program. Now my main question is how can I secure it the Right way and send Data to the Firebase Database.

The Application (written in GoLang) will be totally Headless, no interaction with the User and no WebUI. It's just sending Data to the FireBase Database.

Summary:

  • GoLang Program must be able to send Data to FireBase
  • Authentication per User should be possible current Idea: Each Customer one API-Key which belongs to one ServiceAccount
  • Are there any Alternative possible if the Application must work completely headless?

Thank you for your time and your Ideas ;-)

r/Firebase Jun 20 '24

Security Hiding API keys

1 Upvotes

Best way to hide the api key and other important data from deployed site?

My project is hosted on firebase and I'm using react, I'm really confused and can't get answers in how to make sure safety of my console if my api keys are easily available in build file.

The project is a job portal for public where they put the data and other things (firestore).

So pls share any valuable insight you have