5

I'm creating a web application using Firebase as the backend for data storage, real-time updates, as well as for hosting.

Moving most things client-side is pretty slick, but the issue of security is an important one to address.

For access to data on Firebase, Firebase Security Rules takes care of most things. But, when using Firebase for hosting, I feel like there is a lack of security for accessing certain routes.

Currently, on a page load, I can check to see whether or not a user is logged in. If the user isn't logged in (or if the auth token isn't valid) I can redirect the user to a different page (i.e. a Login page). But, my issue is what if there is information embedded in the static html on that page that I wouldn't want an unauthorized user to see?

I feel like the first answer that I'll receive is, "The data should be kept in a Firebase variable and loaded only if the authorization is successful." While that is a valid option, I'm thinking storage of HTML (or even just paragraphs of text) as a Firebase variable is kludgy, and there ought to be a better way.

Initially I thought that this would be an inherent option in the firebase.json file, as one can define redirects, headers, etc. But, there is nothing in firebase.json for security (like in firebase-security.json) that would allow me perform an auth check such as the following:

 {
   "firebase": "myfirebase",
   "public": "app",
   "ignore": [],
   "rules": "config/security-rules.json",
   "routes": [ {
     "source" : "/for_authorized_only/",
     "destination": "/authorized_page.html",
     "auth": true, //Must be authorized
   }, {
     "source": "/some_public_route",
     "destination": "index.html",
     "auth": false, //No auth required to access this page
   } ]
 }

I haven't tried out AngularJS or AngularFire, but after searching a little it seems like the angularFire-seed project includes route security, however this should be included in Firebase rather than rely on another framework!

Is there something that I'm looking over that would allow me to accomplish this?

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
MandM
  • 3,293
  • 4
  • 34
  • 56
  • As far as I know Firebase hosting doesn't implement user/role based file level security. Anything that you put on Firebase hosting is going to be accessible to everyone. – Frank van Puffelen Oct 14 '14 at 21:13
  • 1
    Route security will not prevent anyone from accessing the files directly. There is nothing in Firebase hosting to provide auth-related security. You wouldn't want to put secured data in static files hosted on a world-wide CDN. – Kato Oct 15 '14 at 14:37
  • 1
    @Kato: unless said CDN implements a security model that matches your needs. They probably exist; but Firebase hosting is not one of them and recommending one goes against the charter of StackOverflow. – Frank van Puffelen Oct 15 '14 at 15:33
  • @Kato, agreed - route security _in its current state_ (or, what I think its current state is) would not prevent anyone from accessing the files directly. I guess I'm hoping at this point that either (1) we're both wrong and there is a way to address this or (2) they're planning on including this in the future. – MandM Oct 15 '14 at 15:35
  • Frank and Kato, thanks for your responses - sounds like I'm somewhat up the creek if I stick with Firebase for hosting. – MandM Oct 15 '14 at 15:36
  • I agree files in Firebase Hosting are, and should, be intended for public access, as it is developed as a CDN (which shouldn't do server-side processing to sustain the reasons of a CDN). **Nevertheless**, the public access to an entire new project in development phase should be hidden from public until it's release (moreover in cases like mine where confidentiality contract is in the middle). My only solution to the moment has been to temporarily make tests under an Apache server to implement Authorization through .htaccess password, and at the moment of release move everything to FB-Host. – DavidTaubmann Jun 14 '16 at 18:38
  • 1
    For that reason, I believe they could activate a simple Web-Server-level Authentication for the subdomain, that could be activated with a simple "realease-switch" from Hosting area in the Console at anytime, and could even be default-activated for hosts that have never been used.. – DavidTaubmann Jun 14 '16 at 18:45

0 Answers0