How secure is Firebase Cloud Messaging on the client side?


Natesh Butter

It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging.

What confuses me is:

We include client-side initialization code in public javascript files or script tags. Does anyone not see this initialization credentials and send the post request directly to the device connected to our app? What if users keep sending spam or malicious notifications? Could it be that the entire FCM functionality can only be provided by the admin sdk?

I'm using Firebase hosting for my project's nodejs app and am very confused on how to implement FCM.

What kind of authentication or inspection does Firebase provide with cloud messaging and notifications?

How secure is it to use FCM notifications in my web application client?

Kushan

Never expose FCM Api keys used in older versions of FCM. If you're worried about it, just disable the GCM post api from your project's Google Cloud Management Console.

Their new v1 API now uses an Oauth token issued via a service account key on the server. This prevents abuse. Never put service account keys in publicly accessible places. You must enable this feature in your project's Google Cloud Admin console.

The database URL, bucket information, application ID and apikey of the db can be safely exposed.

For example, in my web project, a button should be clicked to send a notification and then post the data to a servlet which will actually have the FCM part. Now, this will prevent abuse.

Related


How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How to secure Firebase Messaging theme with cloud functions?

Devxln Is there a way to securely authenticate subscriptions to a topic? For example, is it possible to restrict the topic "test" to a specific user with id XXXXX? Is cloud functionality possible? Frank Vampfelen set fire here To be able to subscribe to a topi

How to secure Firebase Messaging theme with cloud functions?

Devxln Is there a way to securely authenticate subscriptions to a topic? For example, is it possible to restrict the topic "test" to a specific user with id XXXXX? Is cloud functionality possible? Frank Vampfelen set fire here To be able to subscribe to a topi

How to secure Firebase Messaging theme with cloud functions?

Devxln Is there a way to securely authenticate subscriptions to a topic? For example, is it possible to restrict the topic "test" to a specific user with id XXXXX? Is cloud functionality possible? Frank Vampfelen set fire here To be able to subscribe to a topi

How to secure Firebase Messaging theme with cloud functions?

Devxln Is there a way to securely authenticate subscriptions to a topic? For example, is it possible to restrict the topic "test" to a specific user with id XXXXX? Is cloud functionality possible? Frank Vampfelen set fire here To be able to subscribe to a topi

How to secure Firebase Messaging theme with cloud functions?

Devxln Is there a way to securely authenticate subscriptions to a topic? For example, is it possible to restrict the topic "test" to a specific user with id XXXXX? Is cloud functionality possible? Frank Vampfelen set fire here To be able to subscribe to a topi

How to implement Firebase Cloud Messaging on the server side?

Natsumi After migrating to Firebase, I tested using Firebase console to send notifications and it works fine, but I need to send daily notifications at specific times, so I don't use Firebase console, I use previous Cron job to send daily notify. I changed htt

Firebase Cloud Messaging Java Client

Johnny I want to provide push messaging functionality for libgdx games, so I'm thinking of using Google Firebase Cloud Messaging Api. The problem is that I don't know any iOS, so I want to use a Java client on the iOS side. Do you have such a client? Or if I j

Firebase Cloud Messaging Java Client

Johnny I want to provide push messaging functionality for libgdx games, so I'm thinking of using Google Firebase Cloud Messaging Api. The problem is that I don't know any iOS, so I want to use a Java client on the iOS side. Do you have such a client? Or if I j

Firebase Cloud Messaging Java Client

Johnny I want to provide push messaging functionality for libgdx games, so I'm thinking of using Google Firebase Cloud Messaging Api. The problem is that I don't know any iOS, so I want to use a Java client on the iOS side. Do you have such a client? Or if I j

Firebase Cloud Messaging Java Client

Johnny I want to provide push messaging functionality for libgdx games, so I'm thinking of using Google Firebase Cloud Messaging Api. The problem is that I don't know any iOS, so I want to use a Java client on the iOS side. Do you have such a client? Or if I j

Firebase Cloud Messaging Java Client

Johnny I want to provide push messaging functionality for libgdx games, so I'm thinking of using Google Firebase Cloud Messaging Api. The problem is that I don't know any iOS, so I want to use a Java client on the iOS side. Do you have such a client? Or if I j

How secure is client-side HTML sanitization?

PW Kad I've been looking at Pagedown.js lately in hopes of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings, and h

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,

Firebase Cloud Messaging and C# server side code

Paul D I am using FCM in Android and iOS apps. The client code works fine because from the Firebase console, I can send notifications to both platforms without issue. Using my C# code, I can successfully send the notification to the android device, but the not

Firebase Cloud Messaging with server side API push for obj-c

Elbert Valdian Currently, I'm working on implementing Firebase Push Notifications in my app. I found this: [Background] Using the Firebase console, my app can get notifications with remote notifications from the system tray [Foreground] Using Firebase console,

How to use Firebase Cloud Messaging in Eclipse project?

b1065579: I have an eclipse project. I need to include Firebase library. If I was using Android Studio, the steps would be simple: and all its libraries are included. But I don't understand how to include Firebase Cloud Messaging. I can't find how to eclipse i

How to handle data payloads in Firebase Cloud Messaging?

Guevara hero I have this code to get notifications from Firebase Messaging. How to process data with key/value and display it in log or EditText? public class MyFirebaseMessagingService extends FirebaseMessagingService { private static final String TAG =

How Firebase Cloud Messaging unsubscribes from topics

Ian Davis What is the static API URL to remove the token from the subject? I know the POST api call to add the token to the subject is similar to the following: https://iid.googleapis.com/iid/v1/{token}/rel/topics/{topicName} Documentation isn't much use when

Firebase Cloud Messaging - How to add sound to APN

Roy Hinckley When used, when sending the APN to the iOS device's APN HTTP v1 API, the Apple documentation states that if apns-priorityset to 10, then Notifications with this priority must trigger an alert, sound, or badge on the target device The documentatio

How Firebase Cloud Messaging Works on Android

Goh wei yang I'm sending data to FCM server via "Administration App" and would like other "Non-Administration Applications" to be able to receive push notifications whenever the "Administration App" sends data to the FCM Server. For this, I use AWS SNS with FC

How to handle data payloads in Firebase Cloud Messaging?

Guevara hero I have this code to get notifications from Firebase Messaging. How to process data with key/value and display it in log or EditText? public class MyFirebaseMessagingService extends FirebaseMessagingService { private static final String TAG =

How to handle data payloads in Firebase Cloud Messaging?

Guevara hero I have this code to get notifications from Firebase Messaging. How to process data with key/value and display it in log or EditText? public class MyFirebaseMessagingService extends FirebaseMessagingService { private static final String TAG =