How to disable REST API calls for Firebase database?

user_6850171 0
Viewed 562

Having used Firebase BaaS for quite sometime I am wary of the fact that REST API calls can lead to data theft and or huge data downloads by prying eyes..

Even though the rules put forth in the Firebase rules help in avoiding most of the use case problems a simple issue is that allowing users to read part of the database without authentication can surge the data usage if the end user uses malicious code to off load the entire node data using REST API calls.

Case in point: This is the recent Tic-Tac game unveiled in GoogleIO2017 which uses Firebase https://tictactoe-io2017.firebaseapp.com/ although only authenticated users can play the game a simple REST API call https://tictactoe-io2017.firebaseio.com/games.json can retrieve all the game details from the beginning until now.., weighing on the usage charges for the developer

firebase-realtime-database firebase rest
1 Answers

I don't think it's possible to disable the REST API in public endpoints (data you need to fetch even if the user is not authenticated). But there is a way to limit queries using Realtime Database security rules:

  "rules": 
  {
     "my-world-visible-rdb-endpoint":
     {
        ".read": "query.limitToLast>1 && query.limitToFirst < 50",
        ".write": false
     }
  }

The code above will force the client to explicitly limit the results and will reject expensive reads like the example you mentioned.

user_98532110
Related