2

I'm trying to use Firebase Admin on my backend for "faking" client authentication by verifying Id Token in order to use firestore from the backend.

The idea is to use my server as a middleware between my client and firestore.

I can initialize FirebaseAdmin on the backend and verifyIdToken() from client properly, but I don't have an idea for using firestore after that. Can you guys show me a way for doing it?

import * as firebaseAdmin from 'firebase-admin';
import firebaseServiceAccountKey from './firebaseServiceAccountKey.json';

if (!firebaseAdmin.apps.length) {
  firebaseAdmin.initializeApp({
    credential: firebaseAdmin.credential.cert(
      firebaseServiceAccountKey
    ),
    databaseURL: ##########################,
  });
}

// This is working 
function getUser(token) {
  return firebaseAdmin
    .auth()
    .verifyIdToken(token)
    .then((decodedToken) => {
      return decodedToken;
    })
    .catch((error) => {
      return error
    });
}

/* 
Now I want to use Firestore authenticated with this token, should I 
import firebase from "firebase" 
and then try auth() with token?
*/
Gabriel TN
  • 694
  • 1
  • 5
  • 9

1 Answers1

2

Access to Firestore through the Admin SDK always happens with full administrative privileges. There is no way to access Firestore as the user whose token you verified.

If you want to use this middleware approach, you will have to ensure it only accesses data the user is authorized for in the code itself.

Also see:

If the goal is to have tighter control over who can sign in to your app, consider using custom authentication instead - where the server mints a custom token for each user, that the client-side SDK then uses to sign in.

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • Oh I see, thanks for your response! So, if I want to apply auth security for Firestore, I have to use admin auth and then put my logic to restrict access in my API, right? Do you think it's safe? For example, my server uses GraphQL and the client sends firebase auth token in some requests. Is it safe to use firebase admin (auth and firestore) in this case? – Gabriel TN Jan 20 '21 at 23:55
  • 1
    It *can* be secured, but it depends on your skill level and effort in writing code to enforce your security requirements. With the right code it can be as secure as with the right Firebase security rules. – Frank van Puffelen Jan 21 '21 at 00:05