Is it good idea to rotate (remove) firebaseStorageDownloadTokens?

user_6260751 0
Viewed 39

My use case is that I want to stream a video which was uploaded to firebase storage.

My understanding is that when the video is first uploaded a firebaseStorageDownloadToken is created.

Then whenever in the client app I call getDownloadUrl a user gets access to the secret token and can technically share the url with others to watch or download.

I don't really need the long lived access or the videos to be shareable.

Isn't it then more secure to periodically refresh firebaseStorageDownloadTokens with a new value?

That would prevent the stolen urls from working.

And then if a user wants to watch same video again a new url through getDownloadUrl is obtained containing a new token.

Do you think it makes sense as a security measure? What would happen if a firebaseStorageDownloadTokens is changed while I'm watching the video? Would the stream stop emitting?

firebase-storage
1 Answers

While you can definitely revoke the default token, it isn't automatically shared with any users - so the chances of it being abused by them are pretty small. But: users that can upload through the Firebase SDK for Cloud Storage can also call getDownloadURL on the objects they upload and thus generate new tokens. If this is a significant concern for your use-case, you should probably not allow uploads through the Firebase SDK.

There (currently) is no way in the Firebase SDK to generate a URL that automatically expires. If you want that, consider using one of the Cloud SDKs for Cloud Storage, which have the option to generate so-called signed URLs that do precisely that.

user_2091030
Related