Ionic+Firebase应用内购买安全防护及防篡改技术问询

Great questions—these are some of the most common (and critical) pain points when building JS-based in-app purchase flows, especially since Ionic apps are easier to reverse-engineer than native ones. Let’s break down solutions for both your concerns:

Preventing Client-Side Tampering to Unlock Paid Content #

The core issue here is never trusting client-side code—hackers can easily modify JS bundles, tweak local storage, or bypass UI checks. Here’s how to fix that:

• Move all permission logic to the backend: Instead of letting the app decide if a user has access to paid content, always validate their status via a trusted backend (Firebase Cloud Functions is perfect for this). When the user tries to access paid features, the app sends a request to your Cloud Function, which checks the user’s verified purchase status in Firebase and returns a yes/no. The app only acts on that response.
• Encrypt local state (and don’t rely on it): If you need to cache purchase status locally for faster UI loading, use Ionic’s Secure Storage (not regular localStorage) to encrypt the data. But always re-validate with the backend before unlocking any paid content—never treat local storage as the source of truth.
• Obfuscate your code: Use tools like Terser (built into Ionic’s build process) or commercial obfuscators to make it harder for hackers to read and modify your JS bundle. Wrapping your Ionic app in Capacitor also adds a layer of native packaging, which raises the bar for tampering.
• Add Firebase App Check: Enable App Check to verify that requests to your Firebase services (Cloud Functions, Firestore) are coming from your legitimate app. This blocks requests from modified or fake versions of your app.

Securing Firebase Permissions & API Keys #

Your mistake here is letting clients write directly to purchase status fields—here’s how to lock this down:

• Never let clients modify purchase status: All updates to a user’s purchase state must happen via Cloud Functions, not directly from the app. Set up Firestore/RTDB rules so that only your Cloud Function’s service account can write to purchased (or similar) fields. Clients should only have read access to their own user document.
  Example Firestore rule (for a users/{uid} collection):

  match /users/{uid} {
    allow read: if request.auth.uid == uid;
    allow write: if false; // Only Cloud Functions can write via service account
  }
  

• Don’t worry about the Firebase Web API key: That key is meant to be public—its purpose is to identify your app to Firebase, not to grant write access. As long as your database rules are properly configured, even if someone steals the key, they can’t modify data. The secret you need to protect is your Firebase service account private key—keep that only in Cloud Functions or your own backend, never in the app.
• Validate purchases with platform APIs: When a user completes an in-app purchase, the app sends the platform’s (Apple App Store/Google Play) purchase receipt to your Cloud Function. The function then calls Apple’s or Google’s official validation API to confirm the receipt is real, hasn’t been used before, and corresponds to the correct product. Only after that validation passes should the function update the user’s purchase status in Firebase.

Full Secure Flow Recap #

1. User initiates an in-app purchase in your Ionic app and completes it via the platform’s native dialog.
2. The app receives a purchase receipt from App Store/Google Play and sends it (along with the user’s UID from Firebase Auth) to your Cloud Function.
3. Cloud Function validates the receipt with the platform’s official API.
4. If valid, the function updates the user’s document in Firestore/RTDB to mark the purchase as complete.
5. Whenever the user tries to access paid content, the app calls another Cloud Function (or reads the user’s document via allowed rules) to check the verified purchase status, then unlocks content only if the backend confirms it.

Bonus: Add a "restore purchases" flow that calls your Cloud Function to re-fetch the user’s purchase history from the platform, so they don’t lose access if they reinstall the app.

内容的提问来源于stack exchange，提问作者GuyC