Re:Firebase gets better analytics, crash reporting and more
by girvo on Monday November 07, 2016 @10:15PM
(#12897315)
Question: How do you deal with authorisation? I've still yet to come up with a solution I'm happy with unfortunately; I'm currently relying on a custom token generated server-side that grants given users particular claims that I then check in the database rules, but it feels... brittle, I guess.
[ Parent
| on HN ]
Re:Firebase gets better analytics, crash reporting and more
by Kiro on Tuesday November 08, 2016 @02:44AM
(#12898398)
> I'm currently relying on a custom token generated server-side
I don't understand. Where's this server? I thought the point of Firebase was that you don't need a server.
Re:Firebase gets better analytics, crash reporting and more
by girvo on Tuesday November 08, 2016 @06:04PM
(#12904748)
For custom claims on tokens you need a server, unfortunately. I've not found a way around it yet, but I was hoping someone had an idea on how to get rid of it!
Re:Firebase gets better analytics, crash reporting and more
by anshum4n on Tuesday November 08, 2016 @01:20AM
(#12898107)
Exact same thing that we are using for a realtime collaborative app. Generate token on server-side with access to certain keys.
However, we had to redo our json structure once we started thinking authorisation. It sucked and in retrospect should have thought about it earlier, but it seems to work.
Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in mind. Is that why you feel its brittle?
Re:Firebase gets better analytics, crash reporting and more
by girvo on Tuesday November 08, 2016 @06:04PM
(#12904742)
> Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in mind. Is that why you feel its brittle?
That's pretty much exactly it, I guess. It honestly just feels less "secure" than I'd like, even if it's not!