Firebase Cloud Firestore restrict user access (Banking Application)

问题

I am working on a banking app using firebase cloud firestore. I have already set the rules like so:

// Allow read/write access on all documents to any user signed in to the application
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

My database is structured like this:

/consumers/{consumer_id}/transactions/{transaction_id}

the {consumer_id} will contain the account balance for that consumer along with other details and the {transaction_id} will contain the details about each transaction.

So if any authenticated user wanted to say, withdraw money they can do so using the android app/Web app. The problem is, can that same user access the database (eg: update their account balance) using their credentials with the REST endpoints without my knowledge? If so how do I prevent them from doing so?

回答1:

There is no way to limit access to Firestore to just users who are using your app. Anyone who has the configuration data for your Firebase project, can call the APIs in that project. And as soon as you publish your app, you're sharing the configuration data with those users. So you'll have to assume that some malicious user(s) will at some point call APIs on your project without using your app.

For this reason you should enforce all business rules that you have in a trusted environment, such as your development machine, a server you control, Cloud Functions, or... server-side security rules. Since no user can access any of these, even if they run their own code, they'll be forced to adhere to your business rules.

Some examples:

• Each transaction document probably contains the UID of the user who is posting that transaction, and of course users should only be able to post transactions with their own UID. You can enforce this in security rules with something like:

  match /databases/{database}/documents {
    match /consumers/{consumer_id}/transactions/{transaction_id}/ {
      allow write: if request.resource.data.posted_by == request.auth.uid;
    }
  }
  

  So now anyone (no matter if they're using your app or not) can only post transactions if that document contains their own UID. You'll probably want to verify a bit more, such as whether there is even a account document for them, and maybe whether you've verified their account in some way. All of these can typically be done from server-side security rules.

  For more on this, see the documentation on accessing other documents in security rules, the pro-series video on building secure apps, and this video on security rules.

• Since you keep the balance of each account in their parent document under /consumers/{consumer_id}, you'll need to update that document whenever a transaction is posted under it. While this is possible from within security rules, it's going to be quite involved. It's going to be easier to perform this update of the balance in server-side code.

  A good solution for this is to run the code that updates the balance as a Cloud Function that gets triggered whenever a transaction is created (and/or updated if you allow that). Since this code runs in a trusted environment, you can be sure only you can modify it, and thus it can safely update the balance for the new/modified transaction.

来源：https://stackoverflow.com/questions/54167191/firebase-cloud-firestore-restrict-user-access-banking-application