Angular的服务是在客户端还是服务器端处理的？

Question

Lets say i host and serve my Angular with Firebase Hosting , and use the Angular'services to call API to my Firebase Functions , Firestore and Firebase Authentication .

I would like to know is there a chance that the codes or processed data in Angular got a chance to leak:

1) If I hardcoded my API key in the services, will it be a security breach to leak my API key?

2) The data that get from Firestore to Angular Services, and the data processed in Services, are they processed in server side or client side?

Thank you.

Answer 1

Answer to Question 1/ Your API keys will be "public", but it is not a problem, see this "famous" answer Is it safe to expose Firebase apiKey to the public? . So no "security breach".

---

Answer to Question 2/ Your Angular services are executed on the client side, so the data you get from Firestore is processed on the client side. The role of Firebase Hosting is only to send your Angular files up to the client when they are needed (ie requested by the client).

This means that you should probably add some security rules to your Firestore database (and build your queries accordingly) in order to sent to the client only the data he/she can read. Those Security rules are the Authorization part of the Authentication/Authorization mechanism, while Firebase Authentication would be the first part. You can read the documentation about Firestore Security rules here (note that they are something totally different than you API keys), and about Firebase Authentication here .

Finally, note that, with Firebase, the only part of your code that runs in the back-end (ie server side) is the code you write for Cloud Functions. So, if you call, from your Angular application, a Cloud Function (eg a HTTPS Callable function or with an HTTP request) the code of this Function will be executed on the server side and only the resulting data would be sent back to the Angular app (client side).