Secure communication between Flutter App and Web PHP - firebase

I'm learning Flutter myself and need some expert guidance on the right way to do what I want.
I would like to allow the user of my Flutter application to securely send some sensitive data (e.g. email, phone number, name etc.) to my PHP based website (with REST API) and then, after some time, I would like to send a reply (e.g. . text) from my website to the sender's device and displaying it on the User's screen.
I suspect I should use Firebase Cloud Messaging for this - am I right?
I found tutorials that explain how to send data from Flutter-> FCM and from PHP(curl)-> FCM. But I can't find the tutorial explaining how to send data from Flutter-> FCM-> PHP?

Firebase Cloud Messaging is typically used to send messages from the server to the application, when the user may not be actively using it. While it can be used to send messages from the client to a server, it is much less common for that.
That's because calling a PHP API from your Flutter app is no different than retrieving any data from the internet, and can be accomplished in a multitude of ways. One of the simpler approaches is documented in Flutter's fetching data from the internet page and uses the http package.

Related

how can i send notification from flutter-web to flutter-application?

I had a project from two application(flutter application) and three flutter-web on the same firebase i want to send notification from the web to the application.
i searched alot for this and i cant find any answer or solution for this case.
I had a project from two application(flutter application) and three flutter-web on the same firebase i want to send notification from the web to the application.
i searched alot for this and i cant find any answer or solution for this case.
I hope you understand that we can't give you the finish solution here. I would recommend to you to go trough this docs.
What we can do is to explain it a little bit. For your solution I would recommend to use FCM. And how they work is that:
you use the Firebase SDK to receive a token from the client device.
you store that token on one of the Firebase databases
when sending a push notification to a device you would need to do it from the Firebase Cloud Functions and use that token to send the message to it. When you do that the device from witch the token is will get the message.
It doesn't matter what platform the device is (web, ios or android). All of them can receive Push Messages (in Web most of them but nor 100% all).
From your use case I would not recommend to use topics. You want to send messages from device to device and therefore the tokens are the best solution for it.

Can i use firebase cloud messaging without notification permission? (Javascript)

Update: Google Bug Report Description
(as suggested by google dev advocate in comments on answer 1, filed a bug report; updating the content here since it more succinctly and precisely describes the problem)
I do not need or want to show any notifications to my user. And many users are not willing to give notifications permission because they assume they will start seeing notifications.
But I wish to push data to my web page from the server. The web page is active and in the foreground. This is the classic use case that Web Sockets were designed for.
I understand that I could write my own web socket server and somehow try to scale it, or go to some other third-party for an outsourced scalable web socket push solution.
But, isn't this is a very common "sub-use-case" of the messaging that Firebase Messaging is targeted towards? Therefore shouldn't Google support this use case? I can't see any fundamental technical show-stoppers, but since Google is so smart, please do enlighten me if I am missing something on why this cannot or should not be done.
Original StackOverflow Question Text:
I don't need background notifications or service workers. All I want is to send data to the web page when it is currently loaded and in the foreground.
Websockets do not need any permission but they need a websocket server and maintenance. It is difficult or expensive to scale it.
Firebase solves the problem fundamentally but I don't see why it must require a user to give notifications permission even though I only want to push data when the page is loaded; not in the background.
The problem is that Firebase Messaging is only using 1 method to deliver notifications. That is the Push API specification spec, and that specification (wrongly and unfortunately) does not allow a service worker to receive messages without the user allowing an unrelated permission to show notifications.
The fix would be for the Firebase Messaging team to provide a different way to deliver messages to active web pages -- long polling, or websockets.
But it would be extra work for them, and may be not enough people are requesting it.
It's to protect the user's preferences about what your app is allowed to do. The way push messaging works on browsers is by using a service worker. Even though you say you don't need a service worker, you are actually making using of it when using Firebase Cloud Messaging in your app.
Given that, the prompt is necessary because the browser doesn't know what you intend to do with that push message. If the user doesn't trust your app, they should have the right to limit what it can actually do, especially when they're not using your app. Mobile operating systems (iOS, Android) are the same way.

Firebase Cloud Messaging (FCM) - HTTP V1 API or Legacy HTTP API?

Our goal is sending notifications to groups of devices from our backend, and only from server side is possible to know which device should receive the notification.
We've done some attempts with AppCenter because we mostly work with Xamarin iOS/Android/Forms, but now we have the doubt that it's probably better to use directly Firebase API because wider and more powerful.
I see that with new version of API (HTTP V1) is not possible to send a notification to a list of tokens, feature that was available in legacy API using registration_ids parameter (https://firebase.google.com/docs/cloud-messaging/send-message).
Device group name (legacy protocols only)
I cannot use topics because when it's time to send the communication is a server's responsibility to prepare the "mailing list" for notifications.
I was thinking to use device group messaging (https://firebase.google.com/docs/cloud-messaging/android/device-group) but these are part of the legacy api, and I'm not sure if it makes sense/it's possible to use them with new version of API.
Is an option to send a batch of 100-200-500 push notifications each one to only one token? In theory there isn't a limit to notifications which is possible to send, but I'm worried that sending too many of them I could risk to be banned.
Is it better to use legacy API? Also AppCenter (Microsoft) uses legacy API, it's evident because of how the setup works and because from AppCenter's console it's possible to send notifications to a list of tokens, feature unavailable on Firebase's console.
Another person just asked something similar but the answer was to use topics (How to send firebase notification for all user at a time?).
Got here from the link in your comment in my answer here. And just to reiterate my response there, when sending messages to multiple tokens with v1, the suggested approach now is to use Topics Messaging, since registration_ids is not supported.
Is it better to use legacy API?
v1 was described as the more secure, cross platform, future proof way of sending messages to FCM clients. More secure since it uses OAuth2 security model.
However, if your use-case is better with using the legacy API, then I suggest you go ahead with using it.
This page suggests that you should stay with the legacy API if you want to continue to use the multicast feature: https://firebase.google.com/docs/cloud-messaging/migrate-v1
Any apps that use device group messaging or multicast messaging, however, may prefer to wait for future versions of the API. HTTP v1 does not support these features of the legacy API.

Can Firebase be used without clients logging in?

I am working on a project that might use Firebase only for messaging. The goal is for the following to happen:
App registers with Firebase on startup
App sends Firebase token to our server
Our server sends Firebase messages to all clients via the token from step 2
Note there is no step where the user will log into anything or enter any credentials. I am a little confused if this is possible in a production app, as most Firebase documentation talks extensively about different ways to authenticate, either via username/password, OAuth, etc.
The server will be sending different messages to different clients, but that logic will be handled by the server and not by different types of registration to Firebase. I know Firebase supports groups, but to make a long story short it probably won't be leveraged.
Can all this be done on Firebase? Is GCM a better match for these requirements? I feel like we would be throwing away 95% of Firebase and just trying to force it to simplify the messaging part.
Firebase Authentication does not at all affect the way that Firebase Cloud Messaging works. FCM only cares about the token for the app on the device as a means to target the app for messages. It doesn't care at all if the end user is authenticated by any means. If you want to associate a token to a user somehow, using Firebase Authentication or some other system, that's up to you.
FCM is an evolution of GCM. They are powered by essentially the same components. Using GCM doesn't give you any additional constraints or flexibility than FCM, except for the path to integration in your app.

Dynamic Push Notifications

I know that Firebase has recently added support for Push Notifications and while this is a great thing, I only seem to be able to send push notifications manually via the Notifications Panel.
What I'd like to do is to send push notifications within a user scope...Let me explain that. Each User in my App has an account and then each user can join a group. Within this group the user can perform tasks and has a list of chores to do. Now when certain tasks are due for example I want to remind the user of doing it with a push notification. For 1-10 I might be able to pull this off manually, but is there a way to dynamically based on the data in the Database send out Push Notifications?
I know that certain Push Notifications can be created using the Analytics tool such as "Hey you have not visited for 3 days, please come back whatever"... but I'd like to register push notifications such as "I just created a task, this task needs to be done within 3 days. Remind me in 3 days if the task is still not done".
Is this possible with Firebase or do I need to have my own server connecting to Firebase and handling those events?
-xCoder
You need to implement FCM in your client and in a server. Let me put this straight:
First, you need that your client, or app, to register into FCM and get a FCM token that will be used to identify that device uniquely.
Then, store that token wherever you like. It can be into firebase database or other server you may like. I recommend you to store it into firebase if you are using it as a database for your users; that's my case.
Also, you need to implement a http or xmpp server in order to send FCM messages to your registered devices containing the data you are interested in. For example, you can implement a Google App Engine endpoint (can be done with Android Studio and Java) that is quite simple or a NodeJS module, depending on your preferred language.
If you are using Firebase as database you can connect from your server with the appropriate SDK and get the FCM tokens you want from your users, and then send the message to those with data. Don't forget to secure your serve.
The way you implement your server algorithm to send FCM messages depends on your app purposes.
Hope it is clear enough for you. Also you can find all the documentation with a short video that explains the general structure here: https://firebase.google.com/docs/cloud-messaging
You can use cloud functions to trigger on any create, update or delete operation in your database and in the trigger event, you can choose to send in FCM push notifications to the devices of your choice.
Here is the documentation regarding the use and structure of a cloud function: https://firebase.google.com/docs/firestore/extend-with-functions
Hope this helps!

Resources