Serverless security modeling in Firebase

on YouTube ↗21m

" summary

Shopping app uses Cloud Firestore, Firebase Authentication (including Anonymous Auth), and Cloud Functions; default security rules are permissive for Storage and must be locked or narrowed, and Anonymous Auth requires rule awareness. Test rules and functions locally with the Firebase Emulator Suite and use unit tests and CI. API keys are public identifiers, use the Admin SDK for trusted server actions, set function concurrency/timeouts, monitor via Cloud Logging, scan deps with Snyk, batch triggers with Pub/Sub, and consider GCIP for MFA.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 2:39Open source SDKs
3. 3:35DOS protection
4. 6:39API key management
5. 8:11Security Rules
6. 12:23Firebase Authentication
7. 14:54Anonymous Authentication
8. 16:12Limiting Team Access
9. 17:27Open source dependencies
10. 18:58Function Safety
11. 20:34Wrap up

" related talks

• 25mFive tips to secure your appTodd Kerpelman, Mike McDonald · Firebase Summit 2018
• 51mServerless with Firebase in the wildDuncan Hunter · NDC Oslo 2018
• 14mYour guide to server side authentication with FirebaseJeff Huleatt · Firebase Summit 2022
• 55mServerless Applications with FirebaseKyle Paul · MidWest DevFest 2020
• 58mEasy, scalable serverless backend for mobile/web appArman Murzabulatov · JavaScript fwdays’23
• 01mCloud Storage Security Rules update from Firebase Summit #ShortsFrank van Puffelen · Firebase Summit 2022
• 36mWhat you can build with Cloud FunctionsJonny Dimond · GDG DevFest Hamburg 2017
• 26mHow to go serverless in a post-GDPR worldRachel Myers, Sebastian Schmidt · Firebase Summit 2018