3 ms·
I assume that there would be some rate limiting and anti-abuse measures here, like most Google products have. It’s a good question though.
by dantiberian 8y ago
I assume that there would be some rate limiting and anti-abuse measures here, like most Google products have. It’s a good question though.
- badestrand 8y agoHow would an automatic system even prevent unwanted deletion of database entries or that users access others' data? Maybe I am lacking imagination but without server-side validation the practical use cases seem very limited.
- paxy 8y agoThink of it as an API layer and database baked into one.
- jmvoodoo 8y agoCloud firestore supports placing rules on the database to prevent access by users that aren't authorized. You can independently control get, write, update, list, etc. The way the rules work can sometimes be irritating, in particular for list queries, but they do work. In terms of rate limiting the only one I'm aware of is writes to a single record are rate limited. This impacts normal development when making counters that need to be updated, which leads to an odd "sharded counter" model.
- gnode 8y agoIt has this: https://firebase.google.com/docs/firestore/security/rules-structure https://firebase.google.com/docs/firestore/security/rules-st...
- badestrand 8y agoAh, interesting, so you basically put the server side validation code into the database. And nice, it can even handle authentication.
- dillondoyle 8y agoWhen I last looked at Firebase, it seems like they bake auth into database so in this case a user is limited on what data they can read, like a select where uuid === uuid https://firebase.google.com/docs/database/security/user-security https://firebase.google.com/docs/database/security/user-secu.... And I assume non-authenticated read requests don't have access to everything...