0

I am using firebase firestore as datastore for my web based application. The application has 2 different actors.

Supervisor: logs in via a common password set for all supervisors plus the ability to generate unique codes.

User: logs in via the unique code generated by the supervisor.

I am using cloud functions to do the heavy lifting for both actors. Now these functions are protected with cors and whitelist for origins.

I am trying to secure the routes created with cloud functions with a Auth Middleware relying on the concept of if the request is not from authenticated account or not.

I have created a email and password accounts for both actors for the frontend section of my application.

The question is if I am to go with firebase Auth api to get the refresh token and use it as jwt in the Middleware, will it be an issue since let's say 100 supervisor are connected and performing some tasks, and the same thing for the second actor ? Because after examining the refresh token it contains the uid of the account authenticated and using the same account for multiple connection is the blocking stone in this scenario.

Farouk Lakhdhar
  • 33
  • 1
  • 7
  • I'm not sure I understand what you're asking. What is the problem you perceive with the UID that is in the token? – Frank van Puffelen Jun 21 '21 at 23:23
  • the point of a token to be used in every operation is to validate the origin of the request, and a token is generated for every user thus providing uniqueness. For me all the users will be using 1 single email and password, will it be an issue with firebase admin sdk validating that token in the middleware ? – Farouk Lakhdhar Jun 22 '21 at 06:35

1 Answers1

0

the point of a token to be used in every operation is to validate the origin of the request

Firebase Authentication uses ID tokens to verify the user's identity, not the origin of requests. A malicious user in your scenario can get the credentials from the app, and use them in their own code - calling APIs on your Firebase project.

If you want to only allow calls from your own app, consider using the new App Check feature of Firebase.

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807