Firebase 和用户个人资料“安全”

Question

I am currently tackling an issue within my code, which somewhat relates to security. Not in the sense of payment or personal information, but more so just the "ownership" of someones profile.

Currently, a users basic information (name, email, bio, etc) is stored on Firebase, and all information is displayed publicly on their profile.

However, to decide whether the current owner logged in using Firebase Auth is the owner of the profile they are currently on, I run a basic if function.

if(this.userInfo.user_slug == this.$route.params.id && this.user)

then I set "can edit" to true. However, this feels... weak. Can someone just hop in, toggle that to true and get access to the ability to edit the profiles information, even if not the owner? And, if so what is the best/simplest way to make sure that the only person who can edit the profile is the one who is logged in and matchs it.

Thanks!

Answer 1

Currently, a users basic information (name, email, bio, etc) is stored on Firebase, and all information is displayed publicly on their profile.

When using the Firebase Authentication client-side SDK, a user is only allowed to access and update their own profile information. Through these SDKs there is no way for them to read/write other user's information.