Firebase Sending Request to Server from Client Safe Using Socket.IO?

Question

I understand that security rules are the safest way to protect data however it doesn't support my method in storing user data when they click on specific elements. This is because if I turn write == true they are able to change the database willingly which I don't want them to do; I just want to record their input from my website privately.

Hence, my solution was to create another database on the server. Initialise the firebase realtime database on the server.js file. I thought this would be ideal, as the client doesn't access to any of the credentials (And yes I know, even if the user does have it, it's not that bad anyway but just in case).

So if I were to use socket.io to request from the client (all they see is "socket.emit('value', 'value')) then wouldn't it be safe as they are not seeing anything related to the firebase database as it is all on the server (which is not shown to the user)?

I just want clarification on if this is safe and ideal because it seems to logically work if I were to neglect the security rules.

Apologise to the previous users that replied on my previous post, this may be very similar but I have elaborated a little bit more to make what I am doing a bit more clearer.

Thanks for all your help.

Client Code:

 var a = 0; socket.emit('value', a);

Server Code:

 firebase.initializeApp({ apiKey: VALUE, authDomain: VALUE, databaseURL: VALUE, projectId: VALUE, storageBucket: VALUE, messagingSenderId: VALUE, appId: VALUE, measurementId: VALUE }); socket.on('value', function(data) { var ref = firebase.database().ref('node'); ref.set(data); })

Answer 1

The code you shared indeed seems (unlike your first question ) to no longer expose identity of your Firebase project to the caller. So there is no way for the caller to determine the database URL from what you shared.

Whether this is secure enough for your needs, only you can determine. But a few things to keep in mind:

• If a user can find the database URL through another means, your ".read": true, ".write": true rules still allow them to both read all data, and write whatever they want.
• Your code allows writing anything the user wants to the database. You'll want to lock that down either in your code, or with Firebase's server-side security rules.