Using Firebase Remote Config instead of .env file

user_3309470 0
Viewed 531

I am building a react application with firebase integration and the environment variables we are using can be inspected out by taking the page source of the page in a deployed website.

I am interested in knowing some ways to make it safer. the only way I can think is of take values from an API so that its not shown with the code at any point.

To connect to firebase I can use the reserved url method to automatically connect.Firebase remote config allows you to store key value pairs. I was thinking of moving all my env variables out to remove config setup and use it from there. So I can remove my .env file altogether and avoid exposing any hardcoded values.

Have anyone tried this already? what could be the recommended way to make .env values safer?

firebase reactjs environment-variables
1 Answers

You should never load any values that you don't want users to be able to access into the browser, period. The browser is an open book and while you may be able to obscure values by changing where and how they are loaded, you cannot prevent a motivated attacker from reading absolutely anything and everything you do on the client.

This is why Firebase is designed to have API keys and configuration that are safe to be publicly readable -- when you write security rules you are essentially drawing boundaries around what clients can do.

Firebase Remote Config can and should be used for values that are safe for clients to have -- things like feature flags or environment-specific URLs for APIs. It should not be used for sensitive things like private API keys and secrets.

user_2263910
Related