Using firebase validation for nodejs app

I don't know if this will work or if it is correct.

I created an angularjs app and used firebase to provide my app with a "backend" or contain whatever data I need.

Also I don't want to worry about myself when working with authentication and FirebaseSimpleLogin is just an amazing tool to work with.

I could do:

resolve : {
   'isAuthenticated': isLoggedIn
}

      

on my routes so I could prevent them from going to protected routes. So no problem, I already have an authenticated user.

The problem is that I only used firebase to store user data and for auth and nothing else.

Now I want to do some server-side tasks on my server, but I only want logged in users.

How can I tell if a user is authenticated in firebase?

This is what the firebase token generator is for.

Or should I just create an authentication system using nodejs?

+3


source to share


1 answer


Check out the queue template . Ask the user to write entries to the queue, answer them the server.

The really big part of using Firebase as an API / middle man is that the worker (i.e. the server) doesn't have to worry about whether the client is authenticated. Security rules took care of this.

Just write a rule to allow logged in users only:

{
  "rules": {
     "queue": {
         "in": {
            // I can only write if logged in
            ".write": "auth !== null",
            "user_id": {
               // I can only write to the queue as myself, this tells the server which
               // out/ queue the user will be listening on
               ".validate": "auth.uid === newData.val()"
            }
         }, 
         "out": {
            "$userid": {
               // I can only listen to my out queue
               ".read": "auth.uid === $userid"
            }
         }
     }
  }
}

      



Now the user just writes a write to / using push (), then listens on / until the server responds.

The server reads the entries from the in / queue, processes them, and writes them back to the out / user_id path.

No RESTful protocols, no express servers, no headaches.

+6


source







All Articles