I developed an app to test the google login feature using flutter and google authentication. The project is a closed project and only I have access to it. But recently I saw that there was a google sign in from an unknown Email ID. How did the user login without the build of my app? Has my account been hacked? What is going on?
1
votes
I dont think you got hacked. Just delete him. If you really want to change your password you can.
- Uni
I just faced the same problem. I actully had like 56 Unknown email addresses registered under the "user' tab under Authentication heading in my firebase console. Anyone knows why or how this can happen?
- Damandroid
I am also facing the same issue. Please help if any update in this regard.
- kpvsrkp
Same here. Any news on this?
- to_sam
1 Answers
1
votes
Anyone with knowledge of your project's API Keys can access your Firebase Project using simple CURL Commands.
This is why it's a good idea to add restriction to those API Keys
In case you haven't, go to https://console.cloud.google.com and
- Select your project
- Click the menu icon at the top left (hamburger icon)
- Go to API & Services and then credentials
You can view the APIs for your Google Cloud Project (linked to your Firebase Project) and then set restrictions for the API keys, refresh them or restrict access to specific platforms like Android or iOS.
You can also set restrictions on which components of Firebase the API key is allowed to access. For example, if your project doesn't require the use of Cloud Firestore, you can ensure that the API Key cannot be used to make calls to the Firestore Database
All said and done, I would still recommend that you shoot a mail to the Firebase Support team at https://firebase.google.com/support/troubleshooter/contact
