How to build a secure Firestore API for 3rd party developers: SDK vs Firebase REST API vs https functions?

user_13966500 0
Viewed 263

I have to build an API using Firebase, and need some help with design choices. I want to be able to sell the API to users, who can then use it to build/integrate their own applications. Users will have both read and write privileges.

General information:

  • I'm using Firestore db with email & password authentication.
  • Only specifically assigned users may use the API
  • Each user may only access specific documents concerning them.

I've noticed 3 different ways in which an API can be provided to a user of my Firestore db:

  1. https triggered cloud functions (https://firebase.google.com/docs/functions/http-events)
  2. Using the SDK (https://firebase.google.com/docs/firestore/client/libraries)
  3. Using the REST API provided by Firbase (https://firebase.google.com/docs/firestore/use-rest-api)

API requirements:

  • Used only by users that I specifically grant access to (email & password login)
  • I want to limit these users to only a couple of read/write tasks that they're able to perform.
  • It needs to be safe.

My current approach is:

  • Use the 3rd option - the REST API provided by Firebase (thereby giving users the projectId and API key)
  • Add authorised users to the list of authorised accounts on Firbase, and limit access using custom claims and database rules.

My questions:

  • It seems that https functions (option 1) are normally used in API building. Are options 2 and 3 unsafe?
  • What are the normal use cases of the 3 options? When should each be used and when should each be avoided?
  • Are there any obvious flaws in my choice of option 3?
  • Any other useful information about making these design decisions will be much appreciated.

Thank you in advance

google-cloud-firestore firebase-authentication firebase sdk api
1 Answers

TL;DL: It depends on what you want to do with this API and how many and what type of devices/users will be calling it.

Before answering your questions I will list below the advantages of each approach:

  • Cloud Functions:

Cloud Function is a Functions as a Service Solution, so it's also a hosting service for your API, therefore you won't have to provision, manage, or upgrade servers and the API will automatically scale based on the load. Also this option takes into account the pros of SDKs and client libraries, since your code will have to use it to connect to Firestore anyway.

  • SDKs and client libraries:

This is the easiest and more optimized way to reach Firestore, however, environments where running a native library is not possible such as IOT devices will be left out of your solution, so consider this while implementing this option.

  • Cloud Firestore REST API:

Every device properly authorized to access Firestore will be able to do so.

NOTE: For both SDK and REST API you will need to consider hosting of your API, either on Cloud Functions, as mentioned, App Engine Standard, App Engine Flex or a Compute Engine Server Instance.

All that being said, it's up to you and your API's usage and requirements to say which option is best considering the points above.

As per security, I'd say that all option can be secure if firebase rules and firebase auth are set correctly.

user_128577030
Related