Five tips to secure your app
summary
Five concrete security moves: authenticate with Firebase Auth and verify identity via a JWT ID token signed by Firebase, enforce authorization and schema with Cloud Firestore Security Rules (include required fields, types and allowed values), generate matching client models and rules with the Protocol Buffers rule generator, test rules locally with the Firestore emulator and console simulator, prefer Cloud Functions for complex server-side checks, note custom claims are limited to 1,000 bytes and may take up to an hour to propagate.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:14Don't trust your client
- 2:21Okay, you can trust auth
- 2:44An overly-simplistic guide to Firebase Auth
- 4:495: Use Security Rules
- 5:04Firebase Rules are what stands between your client and your database
- 6:21Tip #2: Authorize your users
- 8:49Validate your schema
- 11:24Implement business logic checks
- 12:33But watch out for gotchas!
- 12:45Rules validate queries, not data
- 14:43Custom Auth Claims are Useful!
- 17:15Test Your Rules
- 18:47Consider Cloud Functions
- 21:23Listen to the warnings
- 22:57Keep your employees on a short leash
related talks
21mServerless security modeling in Firebase
40mThree New Ways to Secure Your App with Firebase Authentication
13mSecure your Firebase app from the start
14mYour guide to server side authentication with Firebase
42mHow to Steal a JWT and How to Protect From It
46mA More Secure World for Android Apps
37mBuilding simple and secure account systems on Android
13mVerifying app identity with App Check