Search code examples
firebasefirebase-authenticationfirebase-security

Firebase authentication vulnerability. Unknown users in firebase

enter image description here So I have an app where I have enabled google authentication in my firebase project. 25 people I know were authenticated. When I logged in the backend I saw atleast some 80 entries with some weird sounding email addresses which should not be there. I had to delete all the entries manually, known and unknown ones (didn't needed any after sucessful testing). Now that I want to go live, I am really concerned as to how unknown entires entered my firebase authentication records?

This has recently happened 'again' to another new app/project of mine. This time I disabled that unknown email address and took a screenshot (attached). I really really need to know and understand how safe is data on firestore. If someone can manage to 'hack' the Authentication part and add thir email to Authenticated list of users they may also be able to penetrate the database somehow in future. Please help me in understanding what is happening?

While researching on this, I could only find this similar question but the answer was just not enough explanation for me.

Unknown user in my firebase user authentication (Flutter/firebase)

Solution

  • firebaser here

    Since the configuration data for your project is embedded in the application that you send to your users, any user can take that configuration data and then start calling the API with it. This is not a security risk, as long as you secure access to the data within your project correctly for your requirements.

    See Is it safe to expose Firebase apiKey to the public?

    What it means to correctly secure access to your data is hard to answer, as it depends completely on your use-case.

    For example: the content-owner only access security rules allow a user to enter data in the database, and then they can access the data they entered. With these rules there's no risk if anyone uses the API (and not your app) to do the same. The security rules will ensure they only can access data they're authorized for, no matter what the source is the API calls is.