search

saltycrane / kage

Yet another task manager built with Firebase, Next.js, React, Redux, styled-components, Reactstrap, Flow, and Prettier
https://kage.saltycrane.com
55 stars 8 forks source link

Hardcoded Firebase API key found #2

Open marnixbent opened 2 years ago

marnixbent commented 2 years ago

Hi,

I just stumbled across this line where I found (potentially live ) hardcoded API details for firebase. Take care!

https://github.com/saltycrane/kage/blob/7efb4e3a010d59bd35bf3460c9725a393476f8be/lib/firebase.js#L7

saltycrane commented 2 years ago

Hi Marnix, thank you for alerting me to this. This scared me, but I just looked at the Firebase documentation and it says it is ok to include API keys in the code:

Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules (to control which users can access resources) and App Check (to control which apps can access resources).

Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.

from https://firebase.google.com/docs/projects/api-keys#api-keys-for-firebase-are-different