0

I have the following function that is connected to a switch on/off is any way to limit a protentional abuse of this switch ? , lets say a malicious user automate a bot that will keep Turing this switch on and off causing a constant writes do firestore, the other part of the problem is I got changes by using real time data so this will cause a snow ball effect. is there a way to reject writes to db if certain number of the requests has been reached or is there some better practice to handle such a case ?

const SetDisplayDay = (type: string, bool: boolean) => {
      const docRef = doc(db, colDynamic(state.user)[0], _authContext.currentUser.uid);
      const setDisplay = async () => {
        await updateDoc(docRef, {
          [type]: bool,
        });
      };
      setDisplay().catch((error) => {
        const errorCode = error.code;
        alert(errorCode);
      });
  };
Richardson
  • 1,804
  • 10
  • 38

1 Answers1

1

is there a way to reject writes to db if certain number of the requests has been reached

No, not if you allow direct access from web and mobile clients via security rules.

If you want to fully control access to Firestore, you will need to disable web and mobile access (deny all reads and writes from web and mobile) and force them all through a backend API that you control that makes decisions about whether or not the caller should have access.

See also:

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
  • I was thinking about a work around to this case, if I can find a certain user that is doing this I can ban him for life.. like a user that reads / writes excessed lets say 25k/ 30min then this could be a malicious user – Richardson Jun 12 '22 at 03:25
  • Sure, you can try whatever you want. – Doug Stevenson Jun 12 '22 at 03:33
  • Note though that you now switched from limiting by IP to limiting by malicious user. If you want user-based limit, you can also consider implementing a write rate limit in security rules: https://stackoverflow.com/q/56487578/209103 – Frank van Puffelen Jun 12 '22 at 12:45