I'm trying to build a Kahoot.com clone with Angular.
The first plan was to use a Firestore database with Firebase Functions for the backend logic, but I quickly realized this will not do because I need web sockets for the client to receive realtime updates from the server. The obvious move seems to be to switch to Realtime Database and connect the Angular frontend to it with the Firebase SDK, but I'm skeptical from a security standpoint. If the game logic exists in the frontend (things like making sure people aren't forging question responses from other people), couldn't this easily be exploited?
How should I implement the backend logic? I don't want to deal with scaling a VPS-hosted web sockets sever, but I feel like it might be my only choice at this point.
Or is there a flaw in my understanding of Angular?
If you need realtime updates to be sent from the database to the client, both Realtime Database and Cloud Firestore support that. See the RTDB documentation on listening for value events, and the Firestore documentation on listening for realtime updates.
To secure access to this data, you'll want to use a combination of Firebase's security rules and App Check.
You can still have backend logic too, for which you'd use one of the Firebase Admin SDKs. A simple way to get started would be with Cloud Functions or Cloud Run.