Firebase Storage - how to authorize file download?

user_9042495 0
Viewed 100

When using Firebase Storage, you set security rules for authorization to get the url of a file, for example using getDownloadURL(). But, once a user has that URL, what's stopping hackers from crowd-sourcing the URL?

I know in Google Cloud Storage, you can use signed urls, which is time limited (still not doing real authorization). But I don't see any mention of a getSignedURL in the Firebase Storage documentation. I've seen it on articles about Firebase Storage but never in Firebase's documentation directly.

As far as I can tell, there's no way to do real user authorization for accessing Firebase Storage files. Please tell me I'm wrong.

google-cloud-storage firebase
2 Answers

But, once a user has that URL, what's stopping hackers from crowd-sourcing the URL?

Nothing. In fact, that's precisely the point of a download URL: it gives anyone who has the URL read-only access to the data.

If you want to only grant specific users access to the file, don't generate a download URL but instead use the SDK to access the data, and use security rules to control that access.

Since you clarified that you're asking about web apps: in the JavaScript/Web SDK using a download URL is the only way to get at the data, while for the native mobile SDKs we also have getData() and getFile() methods, which are enforced through security rules.

I know adding such methods for web clients was considered, so it might be worth filing a feature request.

Until that time, if signed URLs fit your needs better, you can use those. Both signed URLs and download URLs are just URLs that provide read-only access to the data. Signed URLs just expire, while download URLs don't.

user_2091030

As noted in the above comments, the web library does not contain any method to access the document with the security rules. If they add this feature, I'll update this answer!

user_90424950
Related