That's my scenario: 1) I am developing an iOS app that uses Firebase storage. 2) My app has custom light-weight authentication mechanism based on Facebook login. 3) All authenticated users can access ANY data in firebase storage. 4) All others cannot.
All I want is to ensure that only my app can access storage. If I would build my own server I would just evaluate each incoming request with some API Key, which is pre-set in app thus all requests coming from my app are resolved successfully. And if somebody other wants to use my API he should know API key.
I see, this is not a solution for WEB-APP, because everybody can see source code (and API key) but this is ok for mobile app, where there is no such possibility.
So my question is: should I bother about it or Firebase already does this work based on APIkey in config file. And in the case I should, what would you recommend?
Maybe I missed something in firebase's docs but I found them unclear about this particular issue.
See Question&Answers more detail:
os 与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
