1

My GoogleService-Info.plist file for iOS was stolen, is it possible to disable access to my Firebase Firestore to all current iOS devices, and reset this file ?

I tried to delete my iOS app in Firebase, but I can still make request from my iPhone... And I need to disable access only for iOS devices not Android.

Nicolai
  • 35
  • 5
  • What do you mean "stolen"? The contents of GoogleService-Info.plist effectively becomes public once you publish your app. There is no private data in there. I suggest reading: https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public – Doug Stevenson Dec 13 '20 at 23:42
  • I was developing my App with a Team and they decided to leave the project, by keeping the source code – Nicolai Dec 13 '20 at 23:44
  • So they can build a code where they can drop collections... – Nicolai Dec 13 '20 at 23:45
  • How can I avoid it ?? – Nicolai Dec 14 '20 at 00:05

2 Answers2

1

As Doug Stevenson pointed out the contents of the GoogleService-Info.plist are public and accessible to every iOS user of your application. Therefore it is inaccurate to say they could be stolen as they're already publicly available.

As explained in the Firebase documentation the file fields contain identifiers used by your application and Firebase servers to route the requests being made to Firestore, Real Time Database and the rest of products the app might be using. Reading the documentation or the post shared by Doug you would see the information exposed is not a security threat.

Moreover, I would like to point out that everybody could try to access your Firestore collections and try to add/drop data. This is indeed expected as Firestore is publicly accessible by mobile and web clients. However, this doesn't mean Firestore is exposed to users to do whatever they please, instead, the actual access is totally under your control by the means of security rules, which enforce what actions a given user could do. In that sense, the developers who left will only have the access level that your security rules grant them, which shouldn't be a threat when having good rules in place.

Lastly, you may revoke the credentials completely removing the application. I'd say it's not a great idea as you would cause a service disruption to app users. Also, this won't improve security or diminish risks.

Happy-Monad
  • 1,962
  • 1
  • 6
  • 13
0

You can remove the app directly from the Firebase console

Before proceeding make sure to check and understand the consequences.

  1. Click on Settings > General;
  2. Scroll down to Your Apps;
  3. Identify the app and click on Remove this app.
Stefano Amorelli
  • 4,553
  • 3
  • 14
  • 30