I am considering using Google's Firebase database for a project, but I am a little concerned with how secure that data will be.

As I understand the flow, the web-based (or mobile) application will contain a copy of the ClientID and use that when the user authenticates to the database. Since there is no explicit server, there is no way to hide that ClientID.

A malicious user could extract the ClientID and connect to the database using his/her own application and then possible corrupt the database.

Is this similar to OAuth 2 implicit flow in the amount of security provided? Am I being paranoid?

1 Answer 1


You should never design application with direct database access. You should build an API on the server which would proxy all the database requests.

For example, when you visit website, that website, server-side, is connecting to database and serving you data and you can't connect to database directly from you web-app running in your browser.

It's not like your browser downloads a javascript website, which connects to the database. This is wrong flow, wrong design, it should never be done this way without server.

Read about multitier applications here: https://en.wikipedia.org/wiki/Multitier_architecture

  • 5
    The whole point of Firebase is to allow server-less applications. Firebase hosts the client code and serves it without the need for a back-end. I agree that using a multi-tiered application would be more secure, but Firebase offers a great deal of convenience and is quite popular.
    – Ralph
    Commented Dec 28, 2017 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .