I am very confused. I started developing in Ionic (still learning) and AngularJS.
Now, I've tried using Firebase as an application back-end. I made a facebook authentication process, and after the user was authenticated an object is added to the database (with these properties: name, user ID and profile picture).
So far so good. I still don't understand if Firebase was designed for client-side only applications (as a replacement for any back-end service), or was it designed for stuff like NodeJS too?
The reasons why I'm asking that, will be presented as examples:
Now for the golden question, Let's say that I need to add a separate "auth_level" (for example) property to the user. This occurs in a .js service (client side). The client has access to it, so he can change stuff like his own username.
return {
'name': userData.name,
'profilePic': 'http://graph.facebook.com/' + userData.id + '/picture',
'userId': userData.id
};
So yeah, I understand that I can create rules to prevent a user from let's say creating a new object, but for the above example - he already has write access for the sake of pushing to the database. It seems to me like the only way of using Fireabse securely having some sort of bridge (NodeJS for example) in the middle, but then Firebase loses the "real-time" feature, right? Or am I wrong?
So first of all - am I missing anything important?
Secondly, if this is indeed insecure, do you recommend any other method for real-time back-end? Like using a database such as MongoDB, and having a Node server doing all the filtering and communicating with clients via web sockets.
I am very new to the whole world of hybrid mobile development and AngularJS in particular, I used to do a lot of PHP (mainly Laravel) but this just seems a bit dark to me. I am not used to the exposure of such sensitive data to the client-side.
Again I am sorry if I might look a bit stupid here, but I would appreciate help.