Firebase 身份验证漏洞。 firebase中的未知用户

Question

So I have an app where I have enabled google authentication in my firebase project. 25 people I know were authenticated. When I logged in the backend I saw atleast some 80 entries with some weird sounding email addresses which should not be there. I had to delete all the entries manually, known and unknown ones (didn't needed any after sucessful testing). Now that I want to go live, I am really concerned as to how unknown entires entered my firebase authentication records?

This has recently happened 'again' to another new app/project of mine. This time I disabled that unknown email address and took a screenshot (attached). I really really need to know and understand how safe is data on firestore. If someone can manage to 'hack' the Authentication part and add thir email to Authenticated list of users they may also be able to p.netrate the database somehow in future. Please help me in understanding what is happening?

While researching on this, I could only find this similar question but the answer was just not enough explanation for me.

Unknown user in my firebase user authentication (Flutter/firebase)

Answer 1

firebaser here

Since the configuration data for your project is embedded in the application that you send to your users, any user can take that configuration data and then start calling the API with it. This is not a security risk, as long as you secure access to the data within your project correctly for your requirements.

See Is it safe to expose Firebase apiKey to the public?

---

What it means to correctly secure access to your data is hard to answer, as it depends completely on your use-case.

For example: the content-owner only access security rules allow a user to enter data in the database, and then they can access the data they entered. With these rules there's no risk if anyone uses the API (and not your app) to do the same. The security rules will ensure they only can access data they're authorized for, no matter what the source is the API calls is.

Answer 2

It may be related to the pre-launch report.

https://support.google.com/googleplay/android-developer/answer/9842757?visit_id=637478112313064713-650300184&rd=1#signin

Step 1: Provide test account credentials if your app has a sign-in screen If your app has a sign-in screen and you want the crawler to test the sign-in process or the content behind it, you need to provide account credentials. Note: You do not need to provide credentials if your app supports 'Sign in with Google', which enables the crawler to log in automatically.

So I guess it is safe.

Answer 3

The user willwhiteapple@gmail.com is the apple testing when your application is in the process of validation from apple before deploy to TestFlight.