0

In my app users can read and write data on Firestore.
In the Firestore Database there Is also a "Credit" document for each user where the balance of coins Is stored.
How can I be sure that no One could modify an APK of the app in order to change the balance?
In the app there are some functions that remove some coins from the balance, my fear Is that someone could change the code and add coins instead.

faccio
  • 652
  • 3
  • 16

3 Answers3

1

assuming that your app implements firebase authentication to authenticate operations on firestore it's safe to say that your app is compiled with a key and it has an hash.. it's not possible to someone to decompile the app, change the code and recompile it with your key.. so the new "hacked" app will have a different key and hash and firebase authentication will not work and your db will be safe

Patrick G.
  • 458
  • 5
  • 7
1

I think you need to secure the data itself. In your scenario I don't think you can have code in the app that simply writes a value to the balance. You need to create a separate API or firebase function to secure what you are trying to do.

Jason Goemaat
  • 28,692
  • 15
  • 86
  • 113
1

If you want to ensure that only your application code can call Firestore, consider enabling Firebase App Check.

Just keep in mind that:

Using App Check does not guarantee the elimination of all abuse

So you'll want to combine it with other security measures, for example through the server-side security rules that Firebase also offers for Firestore.

Also see:

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • so what PatrickGhara said isn't enough? key and hash don't guarantee that my app code can't be changed and recompiled? Obviously I set the rule `allow read, write: if request.auth!=null;` – faccio Aug 24 '22 at 17:02
  • Without App Check, anyone can get your API keys from the app binary, and then make their own API calls with that. Once they do, the rule you suggest does nothing: they can wipe your entire database with a few API calls. – Frank van Puffelen Aug 24 '22 at 17:23