3 ms·

Question: How do you deal with authorisation? I've still yet to come up with a solution I'm happy with unfortunately; I'm currently relying on a custom token ge

• anshum4n 10y ago
  Exact same thing that we are using for a realtime collaborative app. Generate token on server-side with access to certain keys. However, we had to redo our json structure once we started thinking authorisation. It sucked and in retrospect should have thought about it earlier, but it seems to work. Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in mind. Is that why you feel its brittle?
  • girvo 10y ago
    > Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in mind. Is that why you feel its brittle? That's pretty much exactly it, I guess. It honestly just feels less "secure" than I'd like, even if it's not!
• Kiro 10y ago
  > I'm currently relying on a custom token generated server-side I don't understand. Where's this server? I thought the point of Firebase was that you don't need a server.
  • girvo 10y ago
    For custom claims on tokens you need a server, unfortunately. I've not found a way around it yet, but I was hoping someone had an idea on how to get rid of it!