0

I'd like to use a firebase to store data from a web application, which is entirely static-hosted (i.e. all the code is client side). I don't really want the users to have to authenticate - it's basic data capture, nothing personal, and no need for them to have accounts. But I would like to take whatever steps are possible to protect what would otherwise be a 'public' firebase.

So I had this thought. Is it possible in any way to restrict write access to firebase based on where the client code was served from? I.e., is there some way to allow client code that I serve from a specific domain to 'prove' to firebase that it really came from my domain?

Obviously a token of some kind isn't that helpful, since anyone could browse my server, grab the token, and then reuse it in their own code. But the only difference is that their own code wouldn't have originated on my server.

I suppose I'm wondering if, when a JS client makes a request to firebase, there is any way to know with reasonably certainty where that client code came from. I guess it might be something like CORS, but I'm not sure if that's a good analogy. And since my site is entirely static, I can't use the server-side API and authenticate that way.

This doesn't have to be 100% bullet-proof. Just making it tedious or tricky for someone to 'spoof' would be enough.

KENdi
  • 7,576
  • 2
  • 16
  • 31
dsl101
  • 1,715
  • 16
  • 36
  • There is no way to restrict access to Firebase features based on the domain or app that runs the code. See http://stackoverflow.com/questions/18005984/how-to-prevent-other-access-to-my-firebase – Frank van Puffelen Jun 07 '17 at 09:17
  • Tx - I did search, but that one didn't show up :( I thought as much. I'm now wondering if using firebase hosting as the static site offers extra possibilities for this. Will experiment. – dsl101 Jun 07 '17 at 10:45
  • OK. Good to hear that you were looking for that answer. Searching is indeed a bit hit or miss. I have better luck, since I often know what answer I'm looking for. – Frank van Puffelen Jun 07 '17 at 13:37

0 Answers0