Search code examples
javascriptreact-nativefirebase-realtime-databasefirebase-security

How can I stop receiving Firebase database security alerts?

I'm new to React Native. I made an application with words in two languages. All of the words are in the firebase realtime database. Everyday the security warning coming from Firebase. There is no login with a user name and password in the application and I do not want to log in to the application this way. I added anonymous authentication to the app to fix the security issue. I edited the Firebase security rules as follows. But still the same security message comes up. How can I solve this problem?

{
  "rules": {
    ".read": "auth.uid != null",
    ".write": false
  }
}

Solution

  • The rules you have allow anyone who is signed in to your back-end full read access to the entire database. This is only a very basic layer of security. It is also true that this is more secure than just granting everyone access to your database, at least they have to be signed in.

    If you enable any auth provider in Firebase Authentication, anyone can sign in to your back-end, even without using your app. And once they are signed in, they can read anything in your database. I would suggest structuring your security rules in a more secure way. You can have a look at the documentation on avoiding insecure rules.

    If your rules intentionally allow public reading of all data, you don't store any user data, and you are willing to pay the charges for everyone reading all data, then your rules fit your intended usage. In that case the email and alerts are indeed very noisy. Luckily Firebase provides a way to stop these alerts. To stop the alerts you have to follow the following steps -

    • Visit https://console.firebase.google.com/subscriptions/project/your-project-id
    • Then you will get the following page - enter image description here
    • Here under the Realtime Database section you have to just untick the two boxes which are right to Your Realtime Database has insecure rules. The first box which is below In Firebase column will stop Firebase Console alerts and the second box which is below the column Email will stop receiving the alerts on email.

    You can go through this document to know about Firebase Alerts.