3

I understand that in Firebase, you can set Authorized Domains for OAuth Redirects only. That means it doesn't work for Anonymous Authentication as they said:

https://www.firebase.com/docs/web/guide/user-auth.html

For security reasons, if you're using a web-based OAuth flow (Facebook, Twitter, Github, or Google), only domains that you whitelist are allowed to initiate authentication for your app. This does not apply to Email & Password, Anonymous, or Custom authentication methods.

BUT is there a way to make sure the write doesn't happen from another domains?

My security string code

{
    "rules": {
        ".read": "auth !== null",
       ".write": "auth !== null"
    }
}

My login code

  Ref.authAnonymously(function(error, authData) {
    if (error) {
      console.log("Login Failed!", error);
    } else {
      console.log("Authenticated successfully with payload:", authData);
    }
  });

The use case I have is that I need to create a very simple form to fill out on my website. I don't want others to hack into my Firebase URL and write trash into it. I don't want the random visitors to login either. So it's best if the Anonymous Authentication happens in the background so I can get the domain string to pass in security check.

Is there a way to do this?

HP.
  • 19,226
  • 53
  • 154
  • 253
  • No, you cannot use security rules for domain restrictions. – Anid Monsur Oct 25 '15 at 19:45
  • White listing is to prevent CSRF, not to prevent access (hint: [you can't do this on the internet](http://stackoverflow.com/questions/18890330/how-to-make-sure-only-my-own-website-clientside-code-can-talk-to-firebase-back/18897630#18897630)). Use [security rules and auth](https://www.firebase.com/docs/security/guide/user-security.html) to control access. – Kato Oct 26 '15 at 18:10
  • Without the out of the box ability to whitelist domains for anonymous auth - google scripts can do this -, it seems there is no way to have data secured in a public input-type app without a requiring an OAuth login or third-party service. Is this correct? If so then what really is the anonymous login for, since anyone from anywhere can get an anonymous auth token and hence delete the entire node that has anonymous write access? – malcolm Sep 20 '16 at 13:40

0 Answers0