Restrict Google Firebase access to specific HTTP referrers

Question

I have an API key specifically for Firebase and I have it restricted like so:

However, when I connect to Firebase from a different website (on front-end side) it still works. I've tried connecting Google Maps and it doesn't work (because of the wrong referrer) but Firebase works.

How can I restrict Firebase access to specific web domains?

Note: I'm not using Firebase Auth, I'm only using Firestore as a database.

user_7031308 · Answer

Double check if your domain accepts HTTP and HTTPS because both require separate restrictions. Also, try adding restriction that includes a wildcard path.

Here's an example:

https://www.test-domain.com
https://www.test-domain.com/*

http://www.test-domain.com
http://www.test-domain.com/*

Reference: https://cloud.google.com/docs/authentication/api-keys#adding_http_restrictions

Restrict Google Firebase access to specific HTTP referrers

1 Answers