REST API安全隐患咨询：如何验证Firebase登录用户身份？

First off: you’re not overreacting at all. Exposing an API that lets anyone fetch user profiles by guessing UIDs is a serious privacy and security risk. Attackers could easily script a brute-force attack to iterate through possible UIDs and scrape sensitive user data, which violates privacy rules (like GDPR) and puts your users at risk.

Key Security Gaps You’re Missing #

Let’s break down the critical safeguards you need to add right away:

• Block unauthenticated requests entirely: Your current setup lets anyone hit www.example.com/getUserProfile with any UID—this is a huge red flag. Every request must include a valid authentication token that proves the requester is authorized to access that specific user’s data.
• Stop exposing your API directly to the frontend: If this method is fully visible in dev tools, attackers can study its structure (like parameter names, UID patterns) to craft targeted attacks. Route all profile requests through a backend server instead; the backend handles authentication checks before querying the database, hiding your database structure and adding a critical control layer.
• Prevent UID enumeration: If your UIDs are sequential (e.g., 1, 2, 3...) or follow a predictable pattern, attackers can quickly scrape every user’s profile. Switch to non-sequential identifiers (like UUIDs) or add strict rate limiting to block repeated requests from the same IP.
• Practice data minimization: Even if someone slips through, only return the data the requester actually needs. Don’t expose sensitive fields like email addresses, phone numbers, or private metadata unless absolutely necessary.

How to Validate Firebase Users Properly #

Firebase’s UID is a key identifier, but you need to pair it with ID Tokens to verify identity securely:

1. Frontend: Attach the ID Token to every request
   After a user logs in with Firebase, use firebase.auth().currentUser.getIdToken() to get a short-lived ID Token. Include this token in your request header, like:

   Authorization: Bearer <FIREBASE_ID_TOKEN>
   

2. Backend: Verify the ID Token’s validity
   Use the Firebase Admin SDK to validate the token before processing the request. Here’s a quick Node.js example:

   const admin = require('firebase-admin');
   
   async function validateUser(req, res, next) {
     const authHeader = req.headers.authorization;
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
       return res.status(401).send('Unauthorized');
     }
     const idToken = authHeader.split('Bearer ')[1];
     try {
       const decodedToken = await admin.auth().verifyIdToken(idToken);
       req.user = decodedToken; // Attach verified user data to the request
       next();
     } catch (error) {
       res.status(401).send('Invalid or expired token');
     }
   }
   

3. Enforce strict access control
   Once the token is verified, check that the UID in the request matches the UID in the decoded token. This ensures users can only access their own profile. If you need to let admins access other users’ data, add role-based checks (store user roles in Firebase Auth custom claims).
4. Handle token expiration automatically
   Firebase ID Tokens expire after 1 hour. Use firebase.auth().onIdTokenChanged() in the frontend to refresh the token automatically when it expires, so requests don’t start failing unexpectedly.

Final Thoughts #

Don’t skip these steps—user data privacy is non-negotiable. Even if you think your user base is small, a single breach can damage trust and lead to legal consequences. Start with adding authentication checks and rate limiting, then work on hiding your API behind a backend if you haven’t already.

内容的提问来源于stack exchange，提问作者Noman