I am trying to build a node/express/firebase-admin web app using vuejs in the front end but I am kind of confuse lets say I have two routes with express:
"/" the home page where users can sign up and log in and
"/admin" the admin page where administrators can do almost anything that the firebase-admin module can do
The problems is, and this is where I am confuse, the firebase-admin module only allows operations inside the server since there is where it lives the service account file with all the credentials. But how can I pass this privileges to my admin page without using the client SDK?
You cannot put the credentials inside your browser that is why I don't understand what is the communication that takes place between my admin page and the server. Someone on YouTube suggested me to build an api to send secure operations through it but since this endpoints lives inside the browser linked to button events anyone can see it and make requests to my server.
Maybe I am taking the wrong approach, I also thinking in use socket.io to send this secure operations but I think is lees secure than the first. If somebody could point me in the right I will be happy.