TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Be careful when going client-only (Firebase)

63 点作者 foofoobar将近 12 年前

10 条评论

jamest将近 12 年前
[Firebase Founder] Hi Robin,<p>You’re right, some folks don’t fully setup their security rules. We remind our developers to do this, but can -- and clearly need -- to do more. Your suggestion about requiring security rules is a good one. We’ll be going through our customers and providing more personalized feedback on their security rules in the coming days. Also, we are working on additional tutorials and examples to teach our devs how to use our security rules in an interactive way.<p>Thanks for pointing out some of the areas we can improve our examples. They’re intended to illustrate design patterns, not be robust production apps. Again, we can do better here, and the code we use as an example should be bullet proof.<p>Like any application, Firebase-powered apps are only as secure as the developers make them. If you do not control access with security rules, your app could be vulnerable. XSS attacks can affect Firebase apps like any other application.<p>Finally, we would have really liked you to provide responsible disclosure on the specific Firebases you found issue with and given us enough time to speak with those customers before taking this public.<p>We’ll reach out to you via email now.
评论 #6282125 未加载
评论 #6282198 未加载
coderaptor将近 12 年前
Firebase&#x27;s solution isn&#x27;t difficult to configure, it&#x27;s just more difficult when you contrast it with the simplicity and grace provided by the rest of their product.<p>My startup is addressing the usability mainly by acting as a proxy to a client&#x27;s sensitive data storage, and providing a sane set of defaults for very specific applications.<p>This space is awesome, and so is Firebase - Client-side apps are incredibly attractive for MVP development - it&#x27;s almost as slick a feeling as moving from PHP to Rails 10 years ago :)
hrjet将近 12 年前
Completely agree with the implications in this article. My experience in building a Firebase app was that it was easy to design the app&#x27;s first cut, as long as security &#x2F; privacy was not taken care of.<p>As soon as security &#x2F; privacy &#x2F; quota needs to be factored in, the whole model collapses. Security requires a lot of careful and complex design in the FireBase system. And it wasn&#x27;t even possible to implement quotas the last I checked (couple of months back).
groundCode将近 12 年前
Given that the use case for Firebase is taking the place of your traditional server side architecture and storage, it seems kind of obvious that you would have to take heed of the security implications and set them up properly. The security concerns don&#x27;t magically vanish just because you don&#x27;t write the server side code.
评论 #6282322 未加载
caffeineninja将近 12 年前
This person obfuscates the emails poorly in the screenshots. Some of them are still very readable.<p>If only the NSA used this level of blurring in their recent redacted documents...
Kiro将近 12 年前
Requiring Security Rules is a bad idea and would really stall the work flow in projects where you don&#x27;t need them. I have one of those where I don&#x27;t care if people manipulate the data via the console.<p>Anyway, the Firebase team should really address these security issues that keep coming up all the time.
评论 #6282153 未加载
pewallin将近 12 年前
Basically by disallowing read access to &#x2F;users in the Firebase security rules (which you should do), the latter 50% of the article would be moot. However the html injection is interesting, be extra careful to validate data when using dynamic jquery-selectors?
film42将近 12 年前
This was something that really prevented me from pursuing Firebase as a real asset, despite its easy real time socket magic. If there&#x27;s a diagram to &quot;roll your own&quot; after, though, it&#x27;s probably moot (forums&#x2F; chat). Their json-rpc server has a really slick api and they&#x27;ve spent a lot of time on problems such as authentication and data security.<p>You could argue that moot is just a very well designed Firebase app as far as security permissions go, but at least it&#x27;s proof that it&#x27;s possible to rely entirely on pub&#x2F;sub for your app and be fast, scalable, and successful.
评论 #6283737 未加载
schrijver将近 12 年前
Centralised data-stores for user data, didn’t recent developments remind why that’s not a good idea?
Goranek将近 12 年前
Nice DWM setup :)
评论 #6282113 未加载