Firebase Security Best Practices

1. Firebase Security Rules

Security Rules are the most important protection layer. They run on Firebase servers and cannot be bypassed by client code. Default rules after project creation are often too open.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;  // Anyone can read/write anything
    }
  }
}

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Deny everything by default
    match /{document=**} {
      allow read, write: if false;
    }

    // Allow users to read/write only their own document
    match /users/{userId} {
      allow read, write: if request.auth != null
                         && request.auth.uid == userId;
    }

    // Public read, authenticated write
    match /posts/{postId} {
      allow read: if true;
      allow write: if request.auth != null
                   && request.resource.data.authorId == request.auth.uid;
    }
  }
}

2. API Key Restrictions

Firebase API keys in client code are not secrets — they are designed to be public and are secured by Security Rules. However, unrestricted keys can be abused for quota exhaustion. Restrict them in the Google Cloud Console:

1. 1Go to Google Cloud Console → APIs & Services → Credentials
2. 2Find your Firebase API key and click Edit
3. 3Under Application restrictions, add your app's domain (web) or SHA-1 fingerprint (Android)
4. 4Under API restrictions, limit to only the Firebase APIs you use

3. Firebase App Check

App Check verifies that requests come from your legitimate app binary, blocking automated scripts, emulators, and unauthorized clients from accessing your Firebase services.

// Android — enable App Check with Play Integrity
import com.google.firebase.appcheck.FirebaseAppCheck
import com.google.firebase.appcheck.playintegrity.PlayIntegrityAppCheckProviderFactory

FirebaseApp.initializeApp(context)
val firebaseAppCheck = FirebaseAppCheck.getInstance()
firebaseAppCheck.installAppCheckProviderFactory(
    PlayIntegrityAppCheckProviderFactory.getInstance()
)

// Web — use reCAPTCHA Enterprise
import { initializeAppCheck, ReCaptchaEnterpriseProvider } from 'firebase/app-check';

initializeAppCheck(app, {
  provider: new ReCaptchaEnterpriseProvider('YOUR_RECAPTCHA_SITE_KEY'),
  isTokenAutoRefreshEnabled: true
});

After setup, enforce App Check in the Firebase Console for Firestore, Storage, and Cloud Functions to block unauthenticated API access.

4. Authentication Hardening

5. Security Checklist

Related Resources