10

I have a firebase realtime database.
And i have a "like" button app for my website.

But my database is not safe, because everyone can write to my database.
I want is: "allow only incoming data from my website. And block incoming from other sites"

For example:

{
  "rules": {
    ".read": true,
    ".write": allow only incoming data from "www.example.com" and block incoming from other sites
  }
}

How can I do this?
Or how can I set this rule on Firebase console?

Harshit Ruwali
  • 1,040
  • 2
  • 10
  • 22
Melih511
  • 153
  • 2
  • 5

1 Answers1

6

If I understand correctly what you are trying to do, I believe you can do it with the service account linked with your Firebase account. You can manually create a whitelist of URL's allowed to use your API key. The trick is that it is found in the Google Cloud Platform, not the Firebase Console. However, there is a nifty link in Firebase Console that will take you to where you need to be.

(Also, the direct link of where to go is https://console.cloud.google.com/apis/credentials but make sure you are logged into an "Owner" or "Editor" account listed on the "Users and permissions" tab found at step two below.)

Here are the steps:

  1. Log into your Firebase Console and go to the gear icon next to "project overview" in the top left of the Firebase console.

  2. Then navigate to the "Users and permissions" tab

  3. Then click the small blue link underneath the main table on the screen that says "Advanced permission settings".

  4. It should take you to Google Cloud Console. (Make sure you are logged into an "Owner" or "Editor" account listed on the "Users and permissions" tab you were just looking at from the Firebase Console.) Click the menu in the top left of the Google Cloud Console, and go to "APIs & Services"

  5. Then the click sub-menu item "credentials"

  6. Click the desired API key you want to restrict.

  7. And set the websites you want to allow access by clicking the radio button "HTTP Referers" under "Application Restrictions", adding an item, entering the web address, and hitting done to save the changes.

Christopher Moore
  • 15,626
  • 10
  • 42
  • 52
Knox
  • 413
  • 4
  • 9
  • And Yup if you have multiple projects than on just to the right of GCP logo on top left, you can select the project – Yugank Singh Jun 13 '21 at 03:52
  • It's not working ;_; – savram Jun 03 '22 at 00:25
  • I can still access firebase from any URL – savram Jun 03 '22 at 00:30
  • 1
    It does work but here's the thing: it's only for the authentication module. For this to work you need to enable authentication and have a database rule like { "rules": { ".read": "auth != null", ".write": "auth != null" } } The rule seems unsafe because you don't check which user is authenticated, however this is where the domain restriction comes into play. You won't be able to do anything in the database because you need to authenticate, but the authentication is restricted to the domains you whitelisted! – savram Jun 03 '22 at 02:51
  • See https://jsmobiledev.com/article/create-user-account-without-signup-form/ – savram Jun 03 '22 at 02:55