Does firebase hosting benefit from CloudFlare?

user_911930 0
Viewed 10187

I was looking at https://material-ui-next.com who seem to be running on firebase hosting and use CloudFlare on top of it.

This raised a question. Do firebase hosting websites need additional layers for things like DDoS protection? As as I am aware, firebase provides SSL, CDN, DDoS and caching out of the box? When would one want to add CloudFlare on top of that?

firebase-hosting cloudflare ddos cdn ssl
3 Answers

UPDATE: I've moved from Firebase hosting to Netlify

While deploying our website (https://mfy.im) we ran into a similar debate. However, we decided to go with Firebase hosting without CloudFlare

The main reason is the performance:

  • Firebase hosting without CloudFlare: 732ms
  • Firebase hosting with CloudFlare: 1.2s

Using Firebase config json I was able to configure most of the things that I did earlier in CloudFlare.

However, if you're not much concerned about performance, I recommend to use Firebase with CloudFlare due to the following reasons:

  • Firebase provides some basic DDOS prevention, but no rate limiting. See: Rate Limiting on Firebase Hosting
  • Brotli compression - Firebase only provides gzip
  • Pricing - only 10GB bandwidth is free. After that, it's $0.15 per GB. If you enable CloudFlare on top of Firebase it will cover most of your bandwidth
user_33927720

To anyone looking to put Cloudflare or another CDN in front of Firebase - bear in mind that Firebase sees only one IP making a massive number of requests and may decide to block that IP. I'm not sure if this is something happening recently, but here's the (arrogant) response from Google Support on the matter:

The specialist we involved in the issue recommended us to escalate this with one of the Firebase Engineers which we did.

The engineers mentioned us that CloudFlare integration is limited as Firebase hosting already provides content through the Firebase CDN[1] and adding a second CDN on top is discouraged as it can actually bring down the site performance.

This causing a limitation preventing us to allow the cloudflare IPs.

Edit: If you're interested in doing this, Google have opened a "Feature request" here to whitelist / stop blocking CDN IPs:

https://issuetracker.google.com/issues/185590945?pli=1

Please star it if you would like it resolved faster.

user_6569630

We put Fastly in front of firebase. We put it in front of functions AND hosting.

We did this using rewriters to point to the functions, then we requested Fastly to do a force override to pull the hosting domain properly (we were getting site not found).

Using Fastly to pull data from Firebase is working very well. We get additional logging, control of WAF, etc.

We did not have to setup a custom domain in Firebase to achieve this, but we did have to allow Fastly to call with CORS settings.

user_4435540
Related