Serverless security modeling in Firebase

Using secure design principles as our guide, we cover the default security of Firebase services and what developers need to do to configure and secure their applications. Walking through a simple serverless application built with Firebase backend products, we discuss different security threats, from malicious actors to user error. As we go, we build a checklist that you can use to audit your own app's security and protect yourself and your users.

00:00 Intro
02:39 Open source SDKs
03:35 DOS protection
06:39 API key management
08:11 Security Rules
12:23 Firebase Authentication
14:54 Anonymous Authentication
16:12 Limiting Team Access
17:27 Open source dependencies
18:58 Function Safety
20:34 Wrap up

Resources:

Speakers: Jon Skrip, Rachel Myers

Watch more:

#FirebaseSummit

event: Firebase Summit 2020; re_ty: Publish; product: Firebase - General; fullname: Jon Skrip, Rachel Myers;

[bosung]

why should we not put sensitive information in function's environment variables? 19:20

[somevideos]

You mentioned API Key scoping. I can't find documents for this. Where can I learn how to do this? thank you!

[sonxuannguyen]

I have spent hours scouring the entire Firebase channel for a Firebase video in which there is a precious sequence diagram that illustrates the Firebase OAuth Authentication flow but still cannot find it 😢 (Rachel Myers is also in this video). If any one know the Firebase video i'm looing for, please give me the link, I would be very grateful 🥺

[lahiruchandima]

How do I limit the instance count of a firebase function? It looks like there is --max-instances option in gcloud command, but I use firebase deploy to deploy my functions. It doesn't seem to have --max-instances option.

[agung_laksana]

It would be great if Firebase team also provide dedicated video about this separation of privilage at 16:26

[matthewbeardsley]

Could you go over the quotas especially for functions, in the Google console it seems like most quotas are deprecated and then in a separate section when we edit a function we can change the runtime settings and the maximum instances. If a function returns helloworld, would 10 instances allow 10 people to hit that endpoint at one moment in time...I have one function that has scaled to 2500 instances...not sure if that's my bad coding or it is that many requests at once...