Firebase Custom Authentication: Security of Firebase Secret in JavaScript

Question

I would like to use Firebase Custom Authentication in my Angular app. This action is realy simple:

var FirebaseTokenGenerator = require("firebase-token-generator");
var tokenGenerator = new FirebaseTokenGenerator("<YOUR_FIREBASE_SECRET>");
var token = tokenGenerator.createToken({ uid: "uniqueId1", some: "arbitrary", data: "here" });

But there is a warning about security of Firebase Secret in the doc page:

Firebase JWTs should always be generated on a trusted server so that the Firebase app secret which is needed to generate them can be kept private.

I am wondering how can I keep my Firebase Secret private if everyone can view my JavaScript source code and read the Firebase Secret there? Am I missing something or there is no possibility to do this in JavaScript?

This secret should be put on a server you trust and calls to fire base should be proxies through it. AWS just released their API gateway product, which would help you in doing this. — George Stocker
– George Stocker, Commented Sep 23, 2015 at 11:00
@George Stocker Thanks for the hint. AWS = Amazon Web Services? — Knut Holm
– Knut Holm, Commented Sep 23, 2015 at 11:04
that's correct, here's a link to what I was talking about: aws.amazon.com/api-gateway — George Stocker
– George Stocker, Commented Sep 23, 2015 at 11:14

oori · Accepted Answer · 2015-09-23 12:02:22Z

1

The code you quote is to be run on the your nodejs server (hence - server-side javascript).
The server component FirebaseTokenGenerator takes care for generating the token and sending it back to the JS client, after the client has authenticated to your server, with whatever method you want. That's why it's named custom authentication.

answered Sep 23, 2015 at 12:02

oori

5,7511 gold badge34 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Knut Holm Over a year ago

Make sense, thank you. I was about to run my app on static pages webhosting only so I'll try to find another solution but that's definitely not the point of this thread :-)

Collectives™ on Stack Overflow

Firebase Custom Authentication: Security of Firebase Secret in JavaScript

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related