Unrestricted Firebase key can be used for other paid Google APIs

user_819355 0
Viewed 161

Firebase docs suggest firebase auto-created keys should not be restricted and unlike other sercet keys can happily appear in website's source:

Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules. Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.

The API keys auto-created by Firebase, by default, have no restrictions.

Secure your database and Cloud Storage data by using Firebase Security Rules, not by restricting and/or obscuring your API keys.

However, it seems that when we include our firebase key in our source code, it can be used by a malicious attacker to call paid Google services, such as Custom Search APIs which costs $5/5000 queries, thus draining the Google console balance of a poor unsuspecting victim.

Also, it seems adding restrictions to Firebase keys is not working - either preventing the key from working or triggering a creation of a new auto-generated key instead (see here, here, here)

So should we somehow restrict the api-key, hide the key from the website's source or something else?

firebase google-cloud-platform security
1 Answers

I wasn't able to find anything about he malicious attacks using an API Key auto generated and can be restricted without any problem. Most of the posts you commented on have responses on how to solve their problems with the restriction options. Also, google documentation does recommend some API Key restriction.

Also, you have the App check to limit access to the backend services in your Firebase project.

Here there is also an article about security of the API keys in firebase.

So, after testing around and looking through some pages I think it's pretty safe to let some of them unrestricted and another ones restricted depending on what they are accessing to and you shouldn't have any problem.

user_159723250
Related