Does using Firebase Anonymous authentication allow me to secure my Firestore data and Cloud functions to only be accessed by my application?

Question

I'm creating a mobile app that does not have any reason for the users to authenticate. However I don't want other people to write apps or websites that can access my data in Firestore, or call any of my Cloud Functions.

Does this mean I need to implement Anonymous Authentication and then write access rules that require the request to come from an authenticated user?

Or is there a way to write the rules to just say they must come from my application?

Answer 1

We had the same problem: an app for deployment to many people where it needs to be able to only read from firestore documents, but another admin app (actually just a web page) that will not be distributed, that needs to be able to write to those documents.

Our solution is to:

• create another user for the database, with email and password authentication. (We are not allowing users to create accounts -- just having the one static email/password we've created.)
• use only anonymous login for the regular app
• have email/password signin for the "admin app".
• add rules like these for each document:

      allow read;
      allow write: if request.auth.uid == 'notshowingyououridhere-sorry';

We are using ionic with typescript, so the code to do the user/password login is relatively simple:

      firebase.initializeApp(credentials);
      firebase.auth()
        .signInWithEmailAndPassword('[email protected]', 'sorrynotshowingyouourpassword')
        .catch(err => {
          console.log('Something went wrong:', err.message);
        });


      firebase.auth().onAuthStateChanged((user) => {
        if (user) {
          // User is signed in.
          const isAnonymous = user.isAnonymous;
          const uid = user.uid;
          console.log('onAuthStatChanged: isAnon', isAnonymous);
          console.log('userid', user.uid);
        } else {
          console.log('onAuthStateChanged: else part...');
        }
      });

Hope this helps.