How to Build a Secure App in Firebase (Firebase Pro Series)

What people said

Recommends Frank van Puffelen · 2018-12 · Stack Overflow · on “Admin functionality for firebase linked app”

Signing in to Firebase Authentication does nothing more than authenticate the user. It essentially verifies that you are Benny, and that you're not Frank. Any permissions associated with a user come from other places. For example, if you use the Firebase Realtime Database or Cloud Firestore, you have server-side security rules that can enforce that the user can only access data that they're authorized for. In your case you want to allow only some users to use the admin app. For that I'd consider using custom claims [LINK] . With this approach you add a custom claim to the profile of the admin users. This is simplest to do from a trusted environment with the Firebase Admin SDK. For example, i

Recommends Frank van Puffelen · 2020-03 · Stack Overflow · on “role based authorization and role based access control flutter”

The two most common places to store role information are: as a custom claim [LINK] in the Firebase Authentication token for that user, in the database in a document associated with that user. No matter which one you pick, you should be setting this role from within a trusted environment (your development machine, a server you control, or Cloud Functions) as otherwise anyone can change their own role. Once set in either of these locations, you can access the role information in your client-side code, and navigate to the correct screen for that user. Also see: this video on setting up role based access control in security rules [this video] How to create firebase admin user for authentication in ja

Recommends Frank van Puffelen · 2020-03 · Stack Overflow · on “role based authorization and role based access control flutter”

"I understand how the concept works but having a really hard time setting it up in my code." Since your code doesn't show anything about user roles, it's hard to help. What specific code are you asking about? Failing that, I recommend checking out [this video]

Recommends Frank van Puffelen · 2020-08 · Stack Overflow · on “Security of Firestore Database - SwiftUI”

As I explained on your previous question [LINK] , anyone can take the configuration data from your app, and call the Firebase APIs with that data. is this secure? Only you can determine whether your rules are correct for your use-case. These rules allow anyone to read all documents in the /Users collection. In addition they allow any authenticated user to read and write all documents. If that is the use-case you want to support, the these are the correct rules for you. So if you've enabled the anonymous authentication provider in Firebase Authentication, anyone can take you configuration data, write a minimal web page and call firebase.auth().signInAnonymously() and then read all user data w

Recommends Jose German Perez Sanchez · 2021-10 · Stack Overflow · on “Is It possible to navigate or push from splash screen to admin screen or user screen based on the user role?”

To route the user to the correct page based on their role, you can perform the following two common steps: Create or update the database document associated with a user. Use custom claims in the FireStore Authentication token for each user. Here are some videos that could help you to achieve your main goal: [LINK] - Flutter Role-based authorization with Firestore [this video] - Setting up role based access control Here is also additional documentation to review for the database rules: [LINK] [LINK] Blog post: [LINK]

Cites svkaka · 2018-08 · Stack Overflow · on “Firestore dynamically update security rules”

Imagine we have Chat application and in this application, we have many rooms, some private and some for everyone. Every room has an admin who can manage users (can invite and remove). Only members of the room can read and write messages. An Admin is a person who created a room in this scenario. I want to create security rules on room creation and update it on membersChange so only members can read and write the content of the message board. In this case, that's how it could look like: databse/rooms/ private1 admin: memberX members: member1, member2 //only admin can write into members fields messages message1... message2... message3... //only members can write and read messages private2 admin

Cites Frank van Puffelen · 2019-01 · Stack Overflow · on “Firebase Cloud Firestore restrict user access (Banking Application)”

There is no way to limit access to Firestore to just users who are using your app. Anyone who has the configuration data for your Firebase project, can call the APIs in that project. And as soon as you publish your app, you're sharing the configuration data with those users. So you'll have to assume that some malicious user(s) will at some point call APIs on your project without using your app. For this reason you should enforce all business rules that you have in a trusted environment, such as your development machine, a server you control, Cloud Functions, or... server-side security rules. Since no user can access any of these, even if they run their own code, they'll be forced to adhere t

Cites Julian2611 · 2020-11 · Stack Overflow · on “How to create 2 different User group in Firebase AUTH with Flutter”

There is no such concept directly implemented in Firebase Auth as far I know, but you have essentially 2 options: as a custom claim in the Firebase Authentication token for that user in the database using a User collection with documents associated with your users. You should be setting the role from within a trusted environment (i.e. Cloud Functions or even manually) as otherwise anyone can change their own role if you do not secure your documents by access rules. Once set in either of these locations, you can access the role information in your client-side code. you may want to have a look at: [this video]