0

It is very likely the case I am misunderstanding how all of this works as I am still a newer programmer, but in every course I have taken I have been told not to expose any credentials within the code.

In this Firestore documentation, it tells you to store your service account's credentials as a JSON file and include the file in the directory for the SDK to access. Am I wrong in thinking this is a security issue?

Firestore Getting Started Documentation

Under Initializing Firestore

To use the Firebase Admin SDK on your own server (or any other Node.js environment), use a service account. Go to IAM & admin > Service accounts in the Cloud Platform Console. Generate a new private key and save the JSON file. Then use the file to initialize the SDK:

const serviceAccount = require('./path/to/serviceAccountKey.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount)
});

const db = admin.firestore();

Am I missing something here? Why is it okay to do this?

user12457151
  • 853
  • 2
  • 12
  • 25

1 Answers1

1

In fact it depends how we interpret "not to expose any credentials within the code."

Firstly, a main important rule, is to never include secrets (password, or service account keys, or any other confidential data) into the source code, and especially in source code configuration (git / github).

Secondly, in some situation, the only solution to authenticate to a service or API is to use a service account key. In this case, we must keep this file separated from source code, and provide it to app by an environment variable pointing to it.

If your code is running on Google Cloud Platform (App Engine, Cloud Functions, Cloud Run, Firebase Functions...), you can use default authentication provided directly by GCP, and avoid any service account key. Check Firebase documentation.

In this case, you keep it just for development purpose on your local machine.

Thierry Falvo
  • 5,892
  • 2
  • 21
  • 39
  • Thanks for the response Thierry. I am using a cloud function in this case. What do you mean by the default authentication provided directly by GCP? Wouldn't I need to provide a value for keyFileName when instantiating the Firestore db? What would I put here when using the default authentication? – user12457151 Jul 06 '21 at 18:41