[MUSIC PLAYING]
ROSALYN TAN: Hi, I'm Rosalyn, a software engineer at Firebase.
SHRUTI PADAMATA: And I'm Shruti, a software engineer
at Firebase.
ROSALYN TAN: And today, we'll be talking
about how you can build a more secure application right
from the start using Firebase.
Let's say that you, a cat lover, have a grand new idea
for a game called [? Furdle, ?] where
you score points by clicking on as many cats
as you can in a minute.
Players can then enter their name
to have their score submitted to a high score leaderboard.
SHRUTI PADAMATA: That sounds like a great game.
ROSALYN TAN: But a few weeks after you launch your game,
feedback starts rolling in.
And not all of it is good.
One of your users complains that someone is submitting
low scores under their name.
Another user asks why their high scores have been deleted.
And to make matters worse, you realize
that someone has been cheating by writing
impossible high scores directly to your backend.
SHRUTI PADAMATA: What a disaster.
However, this could have been easily prevented by proactively
considering security concerns.
Thinking about security can be intimidating.
And it might be tempting to put it
off until later, after the fun parts of coding
your application features are done.
However, it's important to be thinking about security
from the very beginning.
And Firebase makes it easy to do so.
With Firebase Authentication, Firebase Security Rules,
and Firebase App Check, you can help
protect your services, your users, and their data
from malicious actors.
ROSALYN TAN: So let's consider where [? Furdle ?] went wrong.
One of the first problems the game ran into
was that users could submit their scores
under any identity, resulting in confusion.
This is where Firebase Authentication can come in.
As the name suggests, Firebase Authentication
allows your users to sign in, or authenticate,
within your application.
So they have an identity that can
be associated with their activity in your app.
When users authenticate with your Firebase project,
they receive a unique user ID.
With that user ID, you can associate your users
with their data by storing the user
ID as a field in Database Documents
or in the database path itself.
Now, instead of letting [? Furdle ?] players submit
their scores under any identity they choose,
their scores can instead be mapped
to their authenticated user identity.
Setting up Firebase Authentication
is super simple in the Firebase console.
First, you enable Firebase Authentication.
And then you can enable whatever authentication providers
you want to support in your application,
for example, Google Sign-in, Facebook Login, Sign
In with Apple, or Phone Authentication.
If you choose to enable email password sign-in,
we recommend that you also enable the email link setting
so that you can verify that the email address belongs
to your user.
For integrating client side authentication logic
to your applications, Firebase provides Firebase UI Auth,
a drop-in authentication library available on Android,
iOS, and web that implements complete user
flows for all of Firebase Authentication supported
sign-in methods.
If you want more control over the sign-in experience,
Firebase also provides a Firebase authentication SDKs
for Android, iOS, web, C++ and Unity platforms,
allowing you to implement your own authentication flows
to suit your needs.
With Firebase authentication integrated
into [? Furdle, ?] players can now
be sure that their high scores are attributed to them.
SHRUTI PADAMATA: Name collisions on the high score leaderboard
weren't the only problem that [? Furdle ?] ran into, though.
As you may recall, another [? Furdle ?] loser
provided feedback that their scores
kept disappearing from the leaderboard, deleted
by malicious users.
This is definitely not ideal, but can be easily prevented
by using Firebase Security Rules.
Security Rules are rules that you write that define custom
conditions to authorize users access to specific parts
in your Firebase databases.
Security Rules are enabled by default
for all the Firebase database products,
although with slight variations in the syntax.
Rules for Cloud Firestore and Cloud Storage for Firebase
use a language based on the common expression language
while Realtime Database rules use
a syntax that looks like JavaScript in a JSON structure.
The syntax of both will look and feel familiar to anyone
who has worked with JavaScript.
Combined with Firebase Authentication,
you can use Security Rules to build user and attribute based
access systems to help keep your users' data safe.
However, your security rules are only
as secure as you write them.
So let's take a look at how to set up some secure rules
for [? Furdle. ?]
Security Rules should be in mind early
on when you're thinking about the shape of your data.
Security Rules apply to entire documents, not
individual fields.
So make sure to keep that in mind
when structuring your data.
First, let's consider the data that [? Furdle ?] may store.
A simple [? Furdle ?] database might just
store a collection of games documents, where
each game has a player ID field and a score field.
While players can view all the game entries
on the high score leaderboard, they
should only be able to create a game entry for their own player
ID and delete game entries that they created.
Now, let's build out Security Rules for our data.
Every rules file starts with this boilerplate that specifies
the version and the service.
Within that, we can write statements to match
specific document paths.
The curly braces around gameId mean
that this is a variable we can use in our rules if we need to.
Within each match statement, we can specify
permissions and conditions.
For example, anyone playing should
be able to read the data.
So we just check that the user is signed in.
And anyone is allowed to create a game,
as long as they are the player listed on the game.
Now, let's run this out with the condition to delete.
Only the player listed on the game can delete a game entry.
You can also use the rules to validate user data.
For example, ensuring that the data contains
required attributes or that the data size does not exceed
limits.
Here, we verify that in order to create a new game
document in [? Furdle, ?] the playerId field and score
fields must be populated.
Another useful construct in Security Rules
are functions, which allow you to wrap sets of conditions
and re-use them in multiple places.
Here, we define the isAdmin function,
which is used in both the Delete and the Update rule.
One thing to be careful of, though, rules
are applied as or conditions and not and conditions.
So it's important to avoid broader rules that
grant access using global match statements or wild cards.
These can grant access to your data,
even when there are more granular roles
for a particular document that wouldn't grant the access.
To make it easier to start off, when you're first developing
your app, Security Rules can be enabled in test mode
with open read/write access for 30 days.
You can continue to use Cloud Firestore, Cloud Storage,
and Realtime Database free of charge
until you reach the no cost usage limit after 30 days
by updating your security rules.
Be sure to update your rules to enforce
proper conditions before pushing your app to production.
As you can see, Firebase Authentication
is only part of the security story.
While Firebase authentication allows
you to know who your users are, Firebase Security Rules
and Authorization a powerful mechanism
to write granular access conditions
and help you ensure that your users only have access
to the appropriate data.
ROSALYN TAN: Of course, we can't forget the last issue
that [? Furdle ?] ran into.
A malicious user, wanting to cheat their high score,
bypassed the game and submitted scores directly
to the [? Furdle ?] database.
Luckily, Firebase App Check can help with that.
Firebase App Check protects access to your services
by attesting that traffic to your backends
is coming from your application.
It does so by utilizing platform specific attestation providers,
like Play Integrity on Android, App Attest on iOS,
and reCAPTCHA on web, as well as custom attestation provider
support so that you can better protect your backends no matter
what platform you use to build your app.
App Check is also easy to set up in the Firebase console.
You'll just need to register your application
to use App Check by providing some information
in order to correctly configure the attestation
providers for each platform.
For example, to configure the reCAPTCHA V3 provider
for a web application, you'll need
to enter your reCAPTCHA secret key.
Next, you'll want to configure App Check in your application
code.
Firebase provides Firebase App Check SDKs for Android, iOS,
and web platforms.
And it's super simple to add App Check integration
into your application with only a few lines of code.
If you're adding App Check to your application right
at the beginning of your application development,
which we recommend, then you can turn on App Check enforcement
right away, since you won't have any old application
versions without App Check integration in use.
However, if you're adding App Check to an already launched
app, then you can instead monitor
App Check request metrics to make a decision of when
to enforce App Check based on how
many verified, outdated client, unknown origin,
and invalid requests you have.
Firebase App Check is currently integrated
with Cloud Firestore, Cloud Storage, Realtime Database.
And Cloud Functions.
With more product integrations to come.
Beyond Firebase, App Check also makes
it easy to help protect the API endpoints
on your own self-hosted backends or custom resources
with the help of the Node.js Admin SDK.
App Check also works great with services like Apigee and Cloud
Run to add that extra layer of protection,
letting you rest easy.
With Firebase App Check, [? Furdle ?] users
can be confident that the scores they see on the leaderboard
are from fellow players, instead of cheaters using a command
line.
SHRUTI PADAMATA: And there you have it.
See how by using Firebase Authentication, Firebase
Security Rules, and Firebase App Check,
[? Furdle ?] could have been made more secure
and avoided the issues that they ran into during its launch.
ROSALYN TAN: A question developers may have is
what exactly is the difference between Firebase
Authentication, Firebase Security Rules, and Firebase
App Check.
We hope that following [? Furdle's ?] security
journey has helped clarify things for you.
But just in case, here's a quick summary
of how each of these products helps protect different aspects
of your application.
Firebase Authentication and Firebase Security Rules
deal with user authentication and authorizing user access
to data.
They help protect your users from malicious actors.
Firebase App Check, on the other hand,
focuses on application identity, rather than user identity
to protect you, the developer, from unwanted usage
outside of your app.
Together, Firebase Authentication Firebase
Security Rules, and Firebase App Check
work together to help protect and secure
your Firebase application.
SHRUTI PADAMATA: Thank you for joining
us to learn about how to build secure Firebase applications
right from the start.
Happy developing.
[MUSIC PLAYING]