Search code examples
node.jsfirebasesecuritybotframeworkfirebase-admin

How to secure client -> backend on firebase NodeJS

I'm building a bot hosted on Azure and using firebase for cloud functions (ie proactive messaging, collating data etc.) and for cloud firestore db.

Sorry as I'm a bit new to security and please feel free to just link to any useful resources on the below.

Within my bot code I'm using the admin SDK to access firebase. The bot will have no created users. Firestore rules therefore block read and write access to everyone (as admin SDK still has full access).

I have a couple of questions about security:

  • Is using the admin SDK in this manner (on the bot side) fine? It looks a bit mixed on the firebase documentation - ie https://firebase.googleblog.com/2019/03/firebase-security-rules-admin-sdk-tips.html mentions only using these in trusted environments, which I think the bot should be?
  • Secondly I am trying to send messages from cloud functions to the bot itself. This will just be a post with no sensitive data attached but I would like to authenticate this on the bot side to check it is from the backend. Is there a way to use firebase to do this (ie authenticating on client?). How else can I do this? I've been a bit confused reading about JWTs and encoding etc.

Thanks

Solution

  • Is using the admin SDK in this manner (on the bot side) fine?

    It's totally fine. You don't have security rules there but Cloud functions (or servers) are secure environments so no one can reverse engineer that. You should validate the incoming data yourself. If I assume you are using Discord.JS, then you can just read ID of author and authorize the user:

    const {id} = message.author

// use this ID as an identifier

    You don't have to worry about the ID being false as it's not being passed by any client. Just make sure you fetch resources of that specific user only.

    I am trying to send messages from cloud functions to the bot itself. I would like to authenticate this on the bot side to check it is from the backend

    You don't need to validate that. Anyone can send message through your bot only if they get your bot's token which is a secret on server/cloud function. You must make sure only you have it.