Firebase电子邮件/密码创建用户安全

Question

I'm using Firebase 2.x. If I enable email/password security, how do I prevent a malicious pre-existing user from writing their own javascript code that would do authenticate with my Firebase and then launch a createUser attack? Hypothetically, it might look like this:

var ref = new Firebase(my_fire_base);
ref.authWithPassword({ email : 'pre@existing.com', password: 'validpassword' },
    function(error, authData) { 
        if (!error) { 
             ref.createUser( ... ); // do this a bunch of times
        }
    });

Answer 1

Since this question was cross-posted to Google Groups , I'll quote the answer that was given there :

You do not need to be authenticated to call createUser(). This is by design and how all registration systems work. It is possible for a malicious client to call createUser() a gazillion times, but this is where we build rate limiting into the service we provide and prevent people from doing this. You cannot restrict by specific origins, and even if you could, as you mentioned, this can be easily spoofed.