« first day (4367 days earlier)      last day (582 days later) » 

8:09 AM
o/
@ballBreaker yes I assume
@Tim Lana del Rey is blasting through someone's headphones a little too loud. I'm thinking about you here in the train as the trees go by and the song fades in the background: Tim, where did you go?
 
8:32 AM
lol
Where have you been?
Where did you go?
Those summer nights seem long ago
 
 
3 hours later…
Tim
11:40 AM
Yes
 
oi
tim what was that album from mumford n sons
wilder mind?
looks like it
 
Tim
12:36 PM
Wilder mind is really nice. I have the cd in the car
 
1:08 PM
yes it is
I think you'd enjoy the national too
 
2:13 PM
ok, so going back to being a nerd
if a user sings up using firebase auth from my flutter app
how could I know what data the user can access?
I think I'd have to store the user's ID in my DB
what I understand is that I login in my app -> get a token -> send it to the server -> verify the token -> assuming it is ok I can get my user ID from that token -> run some queries with that ID
but in order to use the user's ID form firebase auth I think I have to store it in my DB
@IvanMilisavljevic SOS :D
is this logic ok?
I mean when i register the user I have to use the firebase user ID in my local DB
I guess
or have a table that contains firebase user ID and postgresql user ID
or maybe there's an easier solution i am not aware of :(
 
2:42 PM
@grrigore for this I made an extra table UserInfo in my database
where the id is the one coming from FireBase
@grrigore that logic is fine, you want to be able to store things like user photo or any other app-related cases to the userID too
 
 
1 hour later…
4:12 PM
~(^_^)~
 
4:33 PM
hello
 
5:18 PM
@MwBakker sorry which one i fine?
Yo boys
 
@grrigore this one
 
Gonna try it
I think it would work
 
you can see how I processed it in my project
 
So you use the firebase Auth id of that user inside your db
 
yes
 
5:37 PM
another db to delete
 
@grrigore my vote for it
 
I think that would work if I switch from firebase to something else
right?
 
you can use firebase user id in your server or link it to some unique id in your db and use that unique for queries related to that user
but never share firebase user id or fcm id to clients
 
but that would add some extra complexity
 
only client sends user id or fcm id to server, server should never send it to other users
 
5:44 PM
ye client would send fcm token to server
i can get userId from that one
but i ll get the fcm id that i d have to connect to my db id
 
I don't think you can get user id from fcm token
 
if i use a table where i store firebase userid and my id
i think it works
 
@grrigore two tables from one of my similar project a few years back: pastebin.com/J2pTdgBZ
 
i ll think about it
i mean i m thinking maybe it could be overegineering
a little
 
oh, ignore token it was my crude implementation of instant login I remember now
@grrigore you have firebase id and fcm id for each user, you bind them both to a uid in your database like "uid, firebaseId, fcmId, username..." makes your life easier, when user signs in you have everything about him in a table
 
5:54 PM
damn man wait
no fcm
just firebase auth
did i say fcm?
so i wanna use fireabase auth and a local db
 
I assumed it ig, we are loosing cricket match to england badly its on my head xD
 
haha
focus on the match dude
 
@grrigore okay, is there any communication happening between the clients or nah?
 
like messages?
 
could be anything
 
5:57 PM
clients as users?
 
yes
 
well could be yes
maybe in the future
like a chatting stuff could happen
 
maybe not messages but like one user shares something and it needs to be sent to a group of users
 
my app is like a reservation app
you have a business and want users to make appointemnts
and you ll have. a management app where u see them
and uses have an app to make appointments
 
now the user needs to tell server who it wanna send it to but it cannot know firebase ids of other users, thats why you need to comeup with your own userid in your database that can be shared with other users
 
6:00 PM
ah so if i wanna message you i have to get your db id and use it
but why it cannot know other firebase ids
does it give access to something?
 
@grrigore yes and not only db id, unique db id should also not be shared, you need unique db id easier to query for internel server database queries and another hard to guess (like not an autoincreament number) id that is shared with users
 
I see
so that would be InternalID, FirebaseID, UserID
something like that
 
@grrigore yup exactly
 
damn
xD
and only UserID would be "public"
 
yes, if you expose internalid you are inviting hackers like sql injections
not 100% sure about sharing firebase uid but I think its somewhere in official docs that says not to do it, looking for it
 
6:21 PM
gotta go OG
thanks for the tips
 
@grrigore pastebin.com/vMaTdRdA thats how I did it back then
@grrigore take care cya
 
thanks man ill have a look
 
6:48 PM
@asim couldnt find that, and my UserInfo records do require a unique ID which are the firebase ID
I do that because FireBase takes care of registration/login at very secure levels and without too much boiler-plate code
but for database I use traditional SQL with REST api (with prepared statements)
 
7:02 PM
@MwBakker yes firebase is still handling reg/login but his backend server needs to communicate with firebase sdk, he needs sdk otherwise if you are sharing firebase ids, I can claim that I am someone else, send his firebase id to server and have access to his account, If I don't use firebase sdk I will have to implement my own password for use with backend server along with firebase auth which defeats the purpose
 
@asim why would he share these ids with client?
if it's flutter we're speaking you can use the SDK to login the user and THEN retrieve the belonging data to this user with that firebaseID in a query
 
if you have sql and rest it means you have a backend, what is your user auth mechanism then if its not using firebase auth sdk?
@MwBakker user SHOULD NOT be able to query just by providing firebaseId only even if its legit user
it needs to be verified that client is indeed the owner of that firebaseId hence the token thingy
can you share my your app so I can demonstrate how vulnerable it is?
jk jk
 
you can in fact see my app I shared my repository privately
don't jump into conclusions we may simply have a misunderstanding
 
7:17 PM
if you have a backend database that is being queried without admin sdk verification based on simply firebaseId then you did it wrong
I am also sensing some kinda misunderstanding ,still think I am right but yeah maybe I wakeup tomorrow, see my messages and be like tf was I saying, happens often
 
Ill clear it
 
just one question, are you saying that firebaseUids are not shared so no one should guess other users firebaseUids thats why you are using it to query database without consensus/usage of admin sdk?
 
seems like you're right here, after authorizing and verifying the user per SDK (logging him in) I am indeed using that firebase ID to get to his UserInfo data
 
ok thats clear, now I have the other question, is your database exposed to queries by your app (direct queries to db) or is it behind some server side code that queries database on behalf of app
 
It's REST, so there are scripts being called. Queries are not performed inside the app, just the link to the php script
 
7:31 PM
I would consider it exposed but lets just conclude it here no one is perfect even I might be doing a thousand things wrong
 
"is your database exposed to queries by your app (direct queries to db)" this is not the case, no querying is done inside the app
but I get your point, the firebaseID is not sufficient to get the data because such ID could be 'guessed' by brute force or whatsoever
 
@MwBakker it only means db port is not open on server, it can still be queried directly by 2 lines of code
@MwBakker ghost stories for you to read at night: firebase.google.com/docs/admin/setup
 
I used this when I was still using FireBase + FireStore
 
thats the stuff I was talking about, looks scary but takes a few mins to implement after you understand the basics of it
 
that token is what I am missing here, since I switched back to SQL database I had to let go of that part and never thought of it again
thinking it would be sufficient to have the user authorized and use his FireBaseID to perform the query
now I realise this is not sufficient, thanks for pointing this out and for the link regarding the token possibility (y)
I'll dig into that
 
7:43 PM
I know that stuff is sneaky and very easy to miss
 
Well before I started I knew security would be my weakness. As I read into it FireBase took care of a lot of that. Problem was my app was fully FireBase including the entire backend. Then I shifted to SQL and solely let user auth be done by FireBase
 

« first day (4367 days earlier)      last day (582 days later) »