I have been working on a problem, where I want to update the value on Firebase Real-time Database.
I am unable to understand is there any way where I can validate my HTTPS request by my custom AUTH key? As I don't want the device to get the auth token from user authentication.
Thanks in advance.
Related
This image shows the Authentication for my Firebase Database Security: Authentication
I only allow Email/Password Sign-in method, everything else is disabled.
I don't allow my users to sign in manually.
My Android app logs in via code and it uses just one set of Email/Password:
My question is how come I am still getting this warning: Warning
I've followed thru the enter link description here but this sample uses Google sign-in method. And all the other samples or discussion I've read use the same method. Has anyone here tried Email/Password Sign-in Method? Thanks!
That authentication and the firebase realtime database are different things. Your authentication method doesn't control who has access to that database.
This means that anyone who has access to the keys, will be able to access your db. So if your client app (Android / ios / web app) access the database directly, your users will be able to do that too.
To secure it you need to use specific read/write rules. Your best explanation will be from their documentation which can be found here https://firebase.google.com/docs/database/security
I'm trying to edit email address and password for other user via code. Is this possible to do without Admin SDK? I'm asking because I dont have backend skills yet. Does Firebase have a method to login user via uid? Maybe this way I will made my goal?
Users can only update their own data in mobile apps using the Auth client SDKs. It would be a gigantic security hole if any user could modify or log in as any other user without credentials.
While preparing my web app for production I am noticing that Firebase saves a lot of users's data once they sign up/register to my app and these data is save on localStorage.
What is my concern is auto generated uid, I don't want users to be able to know their own uid and I don't want that piece of data to be saved on localStorage.
So I have two questions, should I concern about this ? since I do not have so much experience with authentication in general and I am afraid someone could do something...
Is there any way to remove the localStorage and firebase auth to work correctly ?
Cheers
Do not rely on uid to identify an authenticated user. You should only use the ID token JWT for current user, by calling currentUser.getIdToken() and if you are using your own backend server, verify the ID token using the Firebase Admin SDKs by calling verifyIdToken. Learn more about ID tokens: https://firebase.google.com/docs/auth/admin/verify-id-tokens
No , Because firebase auth is part of authentication with server database. if your trying to do like this then your application will not be able to signup or login.
I have been looking for ways to send notifications to specific users and what I found was that I need the device token to do that.
I have tried Firebase and Ionic Cloud Service to do some pushs and it worked fine, but I'm wondering if it's possible to register a service with a key -> value, for exemple, register with the username and the token. If so, how can I do it?
And what is the best service to do it?
Thank you in advance for the help.
P.S.: I'm not asking for code, just the theory.
From you question [for example, register with the username and the token. If so, how can I do it?] I understand following.
You mean to say, there is a mobile app, which user will sign up to use and you want to send the notification to registered user i.e. get send push notification by username.
To solve this, you can follow the steps mentioned below.
On app launch when you get FCM registration token, save it to some intermediate location such as local storages along with device-id, mobile details etc..
Create a backend API which can save username and registration token in DB.
When a user signs up or signs in, then fetch the registration token from local storages, post username, token to backend API to save it. You can make backend API bit intelligent to handle multiple devices of the single user, distinguishable by device-id, mobile details.
Then while sending API from the backend, you can fetch all registration ids of a single user and send the notification to that users using all tokens of that user in FCM API. Use registration ids as JSON array in "registration_id" field. FCM Document - link.
Sometimes I want to send a message through Firebase notifications to one unique user, then I want access the token from that user, so I like to know what is the best practice for get that token at any time?
On initial startup of my app, the FCM SDK generates a registration token for the client app instance.
I can get that token, but if I save that token in Firebase realtime database, I think other people can access that data because it is "set persistent mode on" to access offline data.
My questions is:
Is it possible to get tokens of all users without save that in a database?
Can I get these tokens direct from Firebase Authentication? If not, what is the best practice for access these tokens?
I think other people can access that data because it is "set persistent mode on" to access offline data.
Simply save the registration token details to a secure node. Making sure that only you (or even including the user itself) to be the only ones that can access it. Read more on Understand Firebase Realtime Database Rules.
I can get that token, but if I save that token in Firebase realtime database, I think other people can access that data because it is "set persistent mode on" to access offline data.
Users won't be able to get the data they're not allowed to/wasn't designed to have on their device if you choose to restrict them.
Is it possible to get tokens of all users without save that in a database?
There is no API to get all the registration tokens related to your app. As mentioned in the documentation (emphasis mine):
After you've obtained the token, you can send it to your app server and store it using your preferred method. See the Instance ID API reference for full detail on the API.
It's the developer's (you) responsibility to send and store the registration token to a secure location.
Can I get these tokens direct from Firebase Authentication?
I'm not entirely sure what you mean by this. FCM Registration tokens are different from auth tokens. So, no.
If not, what is the best practice for access these tokens?
So long as you store the tokens in a secure location and make sure that you're always using the most recent/valid token, it should be good.