0

I have implemented "twitter authentication" on my firebase app. as described here: https://www.firebase.com/docs/web/guide/login/twitter.html

It works very well.

Once the user is logged in, he is also able to send some requests to my domain by using XMLHttpRequest.

when I send the XMLHttpRequest's payload I tend to pass the "username" via javascript.

It has just dawned on me that a person using "Chrome Dev Tool" could intercept that and tamper with my username.

Is there a way I can solve this problem ?

==================================================================

Example: Imagine I have my site running here:

www.example.com/

which serves a static page index.html with lots of javascript The page uses firebase api and allows people to authenticate via twitter (or github). Now let's suppose a person (who has signed in) wants to post something. I am currently implementing it like this: https://www.example.com/writeComment?comment=hello&username=jeff&provider=github

My concern is that the sign-in does not save me from a person mucking about with the Chrome console and change the username.

2 Answers 2

1

There is no problem to solve. There is nothing wrong with this. Unless you are sending protected data back and forth between your client and API you need SSL.

Keep in mind client's driven entirely by CORS enabled API's is now the norm. Handling the data securely is up to the implementation team.

In context with the Firebase service itself:

Firebase handles many other security details for you. Specifically, we use strong 2048 bit keys for our SSL certificates, sign authentication tokens with SHA256 HMAC signatures, and use BCrypt for password storage.

https://www.firebase.com/docs/security/quickstart.html

3
  • Thanks but I don't get your point. Firebase is great and secure, no questions about it. My question was more on the fact that since security is handled by firebase (which is great) if I need to submit something to my backend (the domain serving the site) people can still tamper the username (by using the chrome console). So it seems to me that the security is good only to protect the JSON data held by firebase but not sure how to handle the situation described above
    – Zo72
    Feb 9, 2015 at 17:41
  • You might want to consider clarifying your original question. It is an interesting question, but required me to do a double-take to properly understand the user-case. It'll be easier for people to see what you're trying to do if you show a snippet of (pseudo) code that shows the basic flow. Feb 9, 2015 at 19:28
  • @FrankvanPuffelen You are right. I was unclear. Hopefully now it's better
    – Zo72
    Feb 9, 2015 at 20:53
0

If I understand the question correctly, then you have two services clients connect to: Firebase and a back-end server that you manage.

Your back-end server certainly shouldn't trust anything the user sends, even if it is delivered via HTTPS. One simple answer is to send the server the auth token and let it validate the user using this (since the token can't be forged).

A more elegant solution is to cut out the whole process of circumnavigating Firebase and connecting to a REST API. Instead, utilize a queue strategy and have the client write to Firebase.

With security rules in place, the server no longer needs to worry about authentication. If the user can write to a secured path, they are already authenticated and the problem is resolved. Then the server can process the queued request and respond by writing back to Firebase in a secure manner.

In this way, there is no REST API to maintain, no double-authentication, and no overhead. Just let Firebase be the authority and turn every other process--privileged or customer--into a consumer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.