I am new to Web app development using firebase, I am using NodeJs. I have used the Javascript API's provided by firebase for Google SignIn authentication and also accessing real-time database read and write.
The code that I have written for authentication is on the client js files - which is visible in the browser if I look at the page source. For example, I have used '/admin' as a route at client js if user.uid of logged in user matches with admin's uid.. (I am not sure how to protect /admin page..)
Should I not use the Javascript client api's of firebase as it seems to blur security ?
I came to know about Cloud functions which I can use in nodejs server to authenticate, read/write to the database so that keeping my server as in-charge and giving data to the client whenever requested?