Scenario

Fire store model

uid1
  name :john
uid2
  name : alex

Frontend

(react-firebase)

Login with credentials

Requesting Db to give the name of the user with uid = uid1

and User getting uid from firebase.auth.currentUser.uid ( something like this )

Backend

(node js admin sdk for firebase )

checking If uid is valid or not If valid give him the name = john

Hacker Scenario

Hacker got the uid some how

Now Requesting backend to give me data and backend is serving it as it is valid uid

Now user got alerted and change the password but acc. to firebase uid does not change so hacker still has the uid and can get the personal info without any Hassell

Help me !

What is the best practice and how to deal with this scenario can any body help me with it ?????