2

From my understanding, if I use something like firebase to authenticate and download data from the database and host my static web app, which has client authentication system, all my logics are available publicly. Now it's understandable that no one can really do anything unless they are authenticated. They can see the client portals and everything (as the login logic is client side, they can just bypass that) but they won't see any sensitive data.

Is exposing the logic to the public like this safe? Can a hacker use this information to do anything at all?

  • Without knowing more about your client auth system, I think anyone would be afraid to say that this is "safe". – schroeder Apr 17 '17 at 22:50
  • 3
    anyone can do what you allow someone to do. security based on authentication is not very reliable. if your scheme protects against an admin losing his logged-in laptop from a snatch-and-grab, you're safe. – dandavis Apr 17 '17 at 23:19
  • 1
    BitTorrent is a serverless web application and the way it works makes it safe though not completely immune to attacks. – defalt Apr 18 '17 at 4:34
  • @schroeder client auth system: client logs into firebase from their machine. So the firebase SDK is included in the client JS. As far as I know, firebase handles the authentication and sessions. Access to the client portal is based on the firebase authentication. It is possible for a person to just enter the client JS and change the logic that is blocking the client portal. They will able to see the layout of the dashboard, but no data. Because data is downloaded using firebase which will only allow data download if the user is authenticated. – Tahnik Mustasin Apr 18 '17 at 7:36
2

Serverless applications bring with them a lot of benefits for application security, especially when it comes to securing the underlying platform, which is now the responsibility of the cloud provider. You don't have to worry about patching the underlying operating system, application server, and networking. However, serverless applications may still suffer from application layer weaknesses and vulnerabilities. I highly recommend reviewing the Serverless Security Top 10 guide, published by PureSec: https://www.puresec.io/sas-top-10-download

Proper disclosure - I am one of the authors of this whitepaper.

2

This depends on what your definition of "safe" is.

Speaking strictly as an engineer, my definition of a "safe" application is fairly straightforward:

  • Does not expose sensitive information (e.g. credentials, personal information from use of the application) to unauthorized individuals
  • Cannot be leveraged as a "point of entry" for other attacks on other servers, either in my control or not
  • Does not expose sensitive business logic or otherwise proprietary operations based on data stored within it

I omit the "snatch-and-grab" scenario described for an employee internal to your organization who takes data from your system and distributes it, since that is a legal and policy matter more than a technological matter. From a technical standpoint, the major things you can do in this scenario is ensure that the access they have to those systems is revoked and that the credentials used for the app are rotated.

As with most things "online security", it boils down to a level of assumed trust. A properly configured Firebase app will likely guard against unauthorized third-party actors from accessing your data, resist third-party actors from compromising the server in which it's on (it has to be on someone's server somewhere), and it likely won't be eligible as a stepping stone for others to attack other servers.

The issue then arises with the trust of whomever's hosting the Firebase servers. Are they trustworthy and do they have a good track record of maintaining data integrity? What policies do they have in place for a rogue or disgruntled employee either damaging the data (effective DoS) or leaking the data? Where's that drawn up in the SLA we have with them if we have to take them to court over it?

I've toyed with the idea of using Firebase for a few pet projects, but I've never really committed to using it for anything major until I can at least get the legal questions answered. The data I deal with is sensitive enough that one could face jail time for improper handling of it, so we have to be very cognizant of who's handling our data and what the SLAs are for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.