Firestore security rules, allowing access from nodejs API

0
votes

I'm using Firestore as an MVP DB for an API we've got hosted on Heroku. The API doesn't use any authentication outside the OAuth provided by platforms like Slack and Google, and we're also not using any of Firebase's authentication

I'd like to change our security rules away from the insecure allow read, write: if true; but I'm unsure how to write these rules in my context given most of the docs show security rules using Firebase auth or collection visibility

So, a couple questions:

  • Is it secure "enough" that I'm using the Firebase admin SDK on the Heroku server to access Firestore, but that my security rules basically allow access to anyone?
  • If not, How can I write rules that allow access only to a specific Heroku API endpoint?
  • Alternatively, are there better practices I should use to secure the data?

Thanks so much

2
node.jsfirebaseherokugoogle-cloud-firestorefirebase-security

2 Answers

2
votes

The Admin SDK to access the database with special administrative privileges, and bypasses the security rules. So if you only access the database through the Admin SDK, you can lock the database for access by regular users with:

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}
3
votes

For an MVP, I think allow read: if True is not really a problem, depending the data you make available. However, on write, you can easily implement a rule with the incoming data, like that for example :

allow write: if request.resource.data.securityKey === 'custom key shared between firebase and heroku'

A better option would be to use the auth module firebase.auth().signInWithEmailAndPassword(email, password), store an email and password in the env variable of your heroku app and auth from there.