google-services_json file - to commit or not to commit? That’s the question
summary
Explains that the google-services.json is just configuration read by the Google services plugin (open source on GitHub) and contains an API key plus service URLs; warns that storage bucket and database URLs in that file can let outsiders access resources unless Cloud Firestore/Realtime Database/Cloud Storage rules and Firebase Authentication are enforced. Recommends enabling Firebase App Check (Play Integrity, App Attest, reCAPTCHA) — shows metrics for verified vs unverified requests — and says commit only for private repos or reproducible demo projects.
AI-written summary · about
chapters (7)
- 0:00Introduction and Firebase overview
- 2:36Setting up Firebase project
- 4:02Google services JSON file explained
- 6:10Authentication vs authorization
- 8:41Security rules for databases
- 11:53Preventing app abuse with App Check
- 16:05When to commit the JSON file
related talks
31mLet's start using Firebase
41mWhat's New in Google Play Services
53mHuawei Mobile Services Vs Google Play Services?
06mKeeping Google Play Safe: Key privacy and security initiatives and resources
47mDefending Your Users
54mFirebase Analytics for Android, LIVE!
37mContinuous deployement on Android with the publishing API
14mBuild powerful, reliable apps with Google Play services