0

In my app, after a user sends a message to someone, another function is triggered to notify the receiver. For that, the sender has to have the receiver's push token (front end). My question is: Is that safe? Is there a better approach?

I'm using Firebase but I couldn't figure out a way to send this notification through Google Cloud Functions...

Mariana Reis Silveira
  • 131
  • 5

1 Answers1

2

Yes you can treat it as sensitive information. Tokens could contain information that when a malicious user accessed, it can be used to impersonate your app and send their own messages to users. While there's no reported instance (yet), it would be wise to follow the best security practices.

According to this documentation on Sending Notifications with Expo's Push API

We offer the use of an access token alongside the push token as an additional layer of security.

If you're using the expo-server-sdk-node, upgrade to at least v3.6.0 and pass your accessToken as an option in the constructor. Otherwise, pass in the header 'Authorization': 'Bearer ${accessToken}' with any requests to our push API. Any requests sent without a valid access token after you enable push security will result in an error with code: UNAUTHORIZED.

You can check this blog on Implementing Push Notifications with Expo and Firebase Cloud Functions on how to push notifications securely.

Robert G
  • 1,583
  • 3
  • 13