问题
I am creating Android application with Firestore. My app does not require authentication. Is there any security rule to allows everyone read & write to firestore, but only via my app?
I have tried to find some rules, but each of them based on authentication.
Thank you for your help!
回答1:
No, you can't limit access to your Cloud Firestore only to your application.
Since your application needs to know all the details that are needed to access the database, a malicious user can take those details and replicate them with code of their own.
To properly secure access to your database, you'll have to use Firebase's security rules. These are enforced on the server, so can't be by-passed by a malicious user. The logic here is that as long as the interactions with the database follow the rules you've set up, it doesn't really matter who wrote the code.
Also see:
- How to enable access of firestore data to my nativescript app only?
- Why is it okay to allow writes into Firebase from the client side?
- Is it safe to use Firestore and its features via client only?
来源：https://stackoverflow.com/questions/56915802/is-there-any-way-to-give-everyone-access-to-firestore-database-but-only-via-app