How do I prevent un-authorized access to my Firebase Realtime Database?

Question

How do I prevent other users from accessing my Realtime Database via my Firebase URL? What must I do to secure it to only my domain?

Answer 1

First of all, understand that you cannot secure any URL on the internet according to the origin domain--malicious users can simply lie. Securing the origin domains is only useful in preventing cross-site spoofing attacks (where a malicious source pretends to be your site and dupes your users into logging in on their behalf).

The good news is that users are already prevented from authenticating from unauthorized domains from the start. You can set your authorized domains in Forge:

• type your Firebase url into a browser (e.g. https://INSTANCE.firebaseio.com/)
• log in
• click on the Auth tab
• add your domain to the list of Authorized Requests Origins
• select a "provider" you want to use and configure accordingly

Now to secure your data, you will go to the security tab and add security rules. A good starting point is as follows:

{
   "rules": {
       // only authenticated users can read or write to my Firebase
       ".read": "auth !== null",
       ".write": "auth !== null"
   }
}

Security rules are a big topic. You will want to get up to speed by reading the overview and watching this video