[FEATURE REQUEST] Allow Realtime Database connection without authentication

[juanitogan]

This is more of an anti-feature request, I suppose.

I've just begun porting one my games, https://juanitogan.itch.io/sendit-soccer, from another engine to Godot. The first task, however, is to connect to my Realtime Database like I currently am doing in JavaScript. That is, without auth.

The only purpose of the DB is to help initiate P2P connections, thus, no auth needed or wanted. It has other protections against possible abuse. And, well, I'm still in prototype mode anyhow.

I had thought this tool would allow the same type of connection judging by Activation steps 3 and 4 (no mention of auth there)... but, no go. I thought this was a bug at first but the Realtime Database wiki page (and the code) makes it clear auth is needed first.

Thank you.

[BearDooks]

@juanitogan good question. Some of those pages need to be updated, so thank you for bringing it to our attention.

One way around it is to have the app use anonymous authentication in the background. It should fix the issue of needed auth but not forcing a user to log in.

Let me check with the team to see if there is a different way.

Thanks, Chuck

[WolfgangSenff]

We can support that, but I don't know if we should. Not having auth means you can never enforce rules, so as soon as your keys are out there (easily gotten from your program), you're going to get bombarded with stuff. I've seen it happen, blew out someone's database immediately and cost them thousands. I recommend anonymous authentication like suggested. If you really think it's necessary to support, I can make a PR for it, but I really would rather not.

[juanitogan]

In my opinion, feature decisions are up to the service provider and the dev, not the middleman tool. The risks you mention simply don't apply to my use case.

[WolfgangSenff]

They absolutely do apply to your use case. For the time being, I'm not going to implement this because of potential liability concerns. Once I've found an appropriate liability disclaimer that I can add to the repo, I'll add the ability for you to do this, but for now, I will not permit this type of functionality in my codebase, not until I can be sure I cannot be held even partially responsible.

[WolfgangSenff]

Alright. I've talked to someone and I believe the license will cover us. We'll implement this, even though it can only be a bad thing. I don't know how long it'll take. This likely will be a boolean export on the main Firebase scene that can be checked, something like, "Intentionally leave yourself vulnerable to attack?" Hm, too wordy. We'll figure something out, though it will take a little bit of time to remove all headers and query params.

[fenix-hub]

Hi @juanitogan , I really want to add a little sidenote to my collaborators' answers. Please read it carefully. Let's just put aside the fact that phrases like "this thing does not apply my use case" or "I don't need this" won't be for sure the reasons why we will add new features, mostly because the project is open source and any customization can be done with very little effort (depending on the personal feature of course), especially with stuff regarding avoding security. The only reason we are not likely to support this feature (even though we will in the end, but with tons of disclaimers anyway), it's that we really care about security of users who use our plugin, and not just from a "responsability" perspective (I agree with you on the middleman tool), but mostly because bulding this from scratch as a community we have understood how many critical issues could be avoided following the secure path Firebase itself suggests, expecially for unexperienced users. With that said, we will work on this anyway, since from our perspective we are clear and it's just an implementation.

Now, I don't know what "other protections" you are actually using (the one and only protection should be Firebase rules themselves, and authentication - or at least encrypting the export), for sure they are working since you are really confindent and I belive they do, but please give more attention to security anyway. The project you shared (your game on itch) just exposes everything (and even more) required to give you some bad times with Firebase. Of course I won't share anything here, but it's not even something that requires any kind of hacking abilities. This is the typical case were some basic security like Authentication could save a couple of nights. I won't go in further details for obvious reasons , instead would like to contact you privately on this one but don't know how. I'm sure you won't miss this next time, switching from Phaser to Godot.

[juanitogan]

Why would you need a license or disclaimers to cover services from Google, and use cases they have already found valid and support with their own tools? Disposable data is what it is. You may choose to build a fence around it, but Google and I have other priorities with keeping barriers low... for whatever reasons us clueless people have for not protecting our trash heaps better.

But, okay, as long as the group here is willing, I thank you for not making me fork this to provide a more complete tool.

If I knew I was in for such lectures and desires to police my priorities, I would have skipped this abuse and just forked it silently.

[WolfgangSenff]

We need the license/disclaimer to cover us from your usage of it. When you are hacked and lose thousands of dollars, we need to be ensured you can't sue us for providing the tool that you shot yourself in the foot with. It's clear you don't really understand how any of this works, so yeah, we'll lecture you because we, the folks who know a lot better than you, about the mistakes you're making, because we don't want you to put yourself into that situation.

[juanitogan]

"we, the folks who know a lot better than you" :rofl:

And, yet, the concept of disposable data has clearly eluded you.

You have revealed your true self. Enjoy your totally awesome and superior selves. I've got work to do. I disabled the auth in this code hours ago.

[BearDooks]

But, okay, as long as the group here is willing, I thank you for not making me fork this to provide a more complete tool.

If I knew I was in for such lectures and desires to police my priorities, I would have skipped this abuse and just forked it silently.

Please note that this type of response is uncalled for and falls under our code of conduct. Our team tries hard to take every request and make it work, but there are just things we can't do.

https://github.com/GodotNuts/GodotFirebase/blob/main/CODE_OF_CONDUCT.md