Item — HN Reader

Good questions! Security is a top priority for us, and we can handle all of the use cases you mention.

One thing to note is that you don't put your auth credentials into the HTML (this would be very insecure!) -- you rely instead on a trusted service to do the auth and generate tokens for you. We provide a means of doing this called Firebase Simple Login, but you can do this yourself if you want as well. We then use these credentials in addition to a security rules language to define the operations a user is allowed to perform to the database. The security rules are very flexible. We have a video here that explains this: https://www.firebase.com/docs/security-quickstart.html

If you want a full example of security rules in action, check out our Twitter clone Firefeed: http://firefeed.io

1 comments

Thanks for that, I've read and re-read the security and the rules pages of your docs several times, but still have questions.

Reading through the firefeed rules file answered a lot of questions for me, except for these two:

1. Editing an existing tweet isn't allowed (".write": "!data.exists()"). How can you make it not editable, but deletable by the author?

2. How would you securely handle liking/unliking or upvoting/downvoting? write if authenticated, validate for the increase/decrease by one, if the user hasn't modified this before? How would that work? Would there have to be a child list of people who edited this? I'm just really curious about this specific use case as it seems pretty common in many apps, yet seems to me, would be really complicated to implement in firebase?

The details here are a little off-topic for this HN thread. Could you open a thread on Stack Overflow and tag it "Firebase", or shoot us an email (support@...)? We support all of these use cases.

Bummer, I was hoping to see an answer to this right here since it's such an important core concept! It would be worth the time to answer it, for sure.

I'll go hunt for said answer but I imagine some others will not.

I posted this on StackOverflow, as advised, maybe they'll answer us there: http://stackoverflow.com/questions/15728319/implementing-rem...