Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is it possible to retrieve Firebase Cloud Function source code?

I'm writing some Firebase Cloud Functions but I have need to hide a private key, including from Firebase project admins.

If I embedded this key into my source code and uploaded the code myself, would it be possible for anyone to retrieve the source code and thus the key? Either via Firebase or Google?

Many thanks

like image 246
Alistair Lowe Avatar asked Jul 25 '17 09:07

Alistair Lowe


People also ask

How can I get source code from Firebase?

The Firebase Android SDK source code can be found at https://github.com/firebase/firebase-android-sdk. For the SDKs included in the repository, GitHub is the source of truth, though you can also find our project in the Google Open Source directory and on firebaseopensource.com.

Where is the code stored in Firebase?

Your JavaScript or TypeScript code is stored in Google's cloud and runs in a managed environment. There's no need to manage and scale your own servers. Already using Cloud Functions in Google Cloud? Learn more about how Firebase fits into the picture.


1 Answers

Answering precisely to your question: Yes, they can.

The step by step to achieve that is relatively simple

  1. Go into the GCP Functions page
  2. Select the function you want to inspect
  3. Click on source (From there you should be able to see all the files and the code used by that function), or;
  4. Click on variables (From there you should see all environment variables used by your function)

If people being able to see env variables is problematic to you, here's a way to make things more secure:

You can build on what you already and start encrypting those keys before adding them to the codebase or the environment variables. After that, you can use an encryption service such as KMS to decrypt those keys at runtime. In KMS itself you can have a stricter policy in there, only allowing yourself and the function to access that service.

Another great service from GCP is Google's Secret Manager

like image 79
Jean Costa Avatar answered Nov 16 '22 01:11

Jean Costa