How to restrict Firebase data modification?

@Frank van Puffelen,

You mentioned the phishing attack. There actually is a way to secure for that.

If you login to your googleAPIs API Manager console, you have an option to lock down which HTTP referrer your app will accept request from.

1. visit https://console.developers.google.com/apis
2. Go to your firebase project
3. Go to credentials
4. Under API keys, select the Browser key associated with your firebase project (should have the same key as the API key you use to initialize your firebase app.)
5. Under "Accept requests from these HTTP referrers (web sites), simply add the URL of your app.

This should only allow the whitelisted domain to use your app.

This is also described here in the firebase launch-checklist here: https://firebase.google.com/support/guides/launch-checklist

Perhaps the firebase documentation could make this more visible or automatically lock down the domain by default and require users to allow access?

The fact that someone knows your URL is not a security risk.

For example: I have no problem telling you that my bank hosts its web site at bankofamerica.com and it speaks the HTTP protocol there. Unless you also know the credentials I use to access that site, knowing the URL doesn't do you any good.

To secure your data, your database should be protected with:

• validation rules that ensure all data adheres to a structure that you want
• authorization rules to ensure that each bit of data can only be read and modified by the authorized users

This is all covered in the Firebase documentation on Security & Rules, which I highly recommend.

With these security rules in place, the only way somebody else's app can access the data in your database is if they copy the functionality of your application, have the users sign in to their app instead of yours and sign in/read from/write to your database; essentially a phishing attack. In that case there is no security problem in the database, although it's probably time to get some authorities involved.

Update May 2021: Thanks to the new feature called Firebase App Check, it is now actually possible to limit access to your Realtime Database to only those coming from iOS, Android and Web apps that are registered in your Firebase project.

You'll typically want to combine this with the user authentication based security described above, so that you have another shield against abusive users that do use your app.

By combining App Check with security rules you have both broad protection against abuse, and fine gained control over what data each user can access.

Regarding the Auth white-listing for mobile apps, where the domain name is not applicable, Firebase has

1. SHA1 fingerprint for Android apps and

2. App Store ID and Bundle ID and Team ID (if necessary) for your iOS apps

which you will have to configure in the Firebase console.

With this protection, since validation is not just if someone has a valid API key, Auth domain, etc, but also, is it coming from our authorized apps and domain name/HTTP referrer in case of Web.

That said, we don't have to worry if these API keys and other connection params are exposed to others.

For more info, https://firebase.google.com/support/guides/launch-checklist