I've been searching for ways to rate limit requests by IP, but was not able to find any resources. Basically what I'm looking is a way to implement firewall logic. I know that I can limit authenticated user requests with database rules, but how do I go about limiting page hits? For example I only want to allow 150 requests per minute for each IP. Is there any way to do this? Otherwise, wouldn't it be easy to attack small businesses who are on Blaze plan?
Firebaser here.
There is currently no way to rate-limit based on IP address with Firebase Hosting. Our CDN partner includes some built-in protection against (D)DoS attacks, but this is not presently configurable.
We find that this generally isn't a problem. If you do run into usage that you suspect is abuse, please reach out to Firebase support and we'll work with you to resolve the situation to everyone's satisfaction.