如何正确保护我的REST-API

Question

I am developing an android application and using firebase for the authentication. When a user signs up or logs in, I save the uid generated by firebase on my DB through my API which is built using laravel framework. How exactly do I go about protecting my API endpoints as authentication is not carried out through the API but with firebase? Thanks

Answer 1

即使您的身份验证是由Firebase完成的，您也只需阻止对API的未经身份验证的请求得到响应，而这完全在您的API上完成，一旦用户通过Firebase进行身份验证，您就可以处理对API的所有控制权，否则返回到Firebase进行身份验证。