0

I have a Firebase app using Realtime Database and cloud functions

In my app, a user is part of a group and has access to all the data in the group

I'm trying to create a way for a user to invite another into a group

Example:

  • First, Alice logs in.
  • She creates a new invite URL
  • In the database, a new entry is created, containing a random uid, the expiration token and a random 32 bytes hex string (so 64 chars long).
  • Alice sends the link to Bob
  • Bob logs in, then a firebase cloud function is called with Bob's auth uid, the group uid, the invite uid and the invite token
  • The cloud function verifies that all the info matches, then deletes the invite and adds Bob to the list of users that have access to Alice's Group

Here's the Database Structure after Alice has created the invite link:

{
  "groups":{
    "alice_group_uid":{
      "name":"Alice's Group",
      "users":{
        "alice_uid":true
      },
      "invites":{
        "token_uid":{
          "expiration":1632338701203,
          "token":"5bb7b3f102b0a9fc66d9a447ae52590fd23eb2a150ff7568dc9ce62126d9c8dd"
        }
      }
    }
  },
  "users":{
    "alice_uid":{
      "name":"Alice",
      "groups":{
        "alice_group_uid":true
      }
    },
    "bob_uid":{
      "name":"Bob"
    }
  }
}

The invite links is https://myAppUrl.com/invite?group=alice_group_ui&invitekey=token_uid&token=5bb7b3f102b0a9fc66d9a447ae52590fd23eb2a150ff7568dc9ce62126d9c8dd

It is generated with:

import { randomBytes } from 'crypto';

randomBytes(32, (e, buff)=>{
  const token = buffer.toString('hex');
})

The invite entry uid is generated from a firebase unique push id

I'm wondering if it is enough or overkill? Instead of generating random bytes, I could also hash the expiration date and the invite entry uid. Or could I just use the firebase unique push id and forgo the random token entirely? Or use the token as the key?

What's the best way to make this secure enough?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.