How to block firestore REST API access

user_3607358 0
Viewed 285

I have a flutter app and use firebase auth and firestore. The data in firestore is only read and written from within the app.

I just realized, that every authorized user can access his data in firestore via the REST apis, if he has a correct auth token (e.g. from the AUTH rest api) and the API_KEY. As I understand, the API_KEY is not private.

So, even if I set up my security rules correctly, so that a user can only read and write his data, he could still access and change the data via the REST API. This could break my data model, as the data has to be structured in a special way.

Is there any way to allow access to firestore only from within the app and block it from REST calls?

Why are firebase API keys default unrestricted?

Should I limit the key to be used only by the Android APP like described here?

firebase-security google-cloud-firestore firebase rest
1 Answers

You should be validating the data requests within Security Rules to ensure that your data structure is being adhered to in all cases. https://firebase.google.com/docs/rules/data-validation

as for the Rest API, it is not possible to outwardly block or deny it as it is built into GCP's core as part of the public API, however, you may be interested in App Check which can deny requests from outside your Android/iOS/Web app https://firebase.google.com/docs/app-check

it's in early Beta and can help with unsolicited abuse to the mentioned platforms.

user_23011610
Related