当离线模式处于活动状态时，react-native-firebase 是否安全？

Question

Where the firebase offline data stored, Is that secure? I have some important id like UID which it is available in all user messages ( online, offline ), and actually in firebase security rule I have to check only that.

I tried to encrypt it, but I faced with decryption in firebase security rule, because there was not any decryption possibilities, so how can I secure the offline data which is available on users phone.

Answer 1

First off: UIDs are not secrets, so in general you can freely share them with other users of the app. In fact, that is often necessary to make a meaningful app. See Firebase - Is auth.uid a shared secret?

You'll want to always ensure you check any values written and read against the request.auth.uid value, which is automatically populated by Firebase. This value comes from the ID token that is sent with each request, and cannot be spoofed by a user.

Writes to the local cache are not immediately checked against your database's security rules, since those are only enforced once the write reaches the server. But that typically doesn't matter, since it just means that a local user can spoof the data they write to their own cache. If they write something with a different UID there, it'll be rejected once your server-side security rules see the operation.