Security Config File Firebase
Is it safe to keep the firebase config file (with the APIkey)when deploying my mobile app (front-end react native) to the google play store and app store?
How can I make it safer?
firebase edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
add a comment |
Is it safe to keep the firebase config file (with the APIkey)when deploying my mobile app (front-end react native) to the google play store and app store?
How can I make it safer?
firebase edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
2
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21
add a comment |
Is it safe to keep the firebase config file (with the APIkey)when deploying my mobile app (front-end react native) to the google play store and app store?
How can I make it safer?
firebase edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
Is it safe to keep the firebase config file (with the APIkey)when deploying my mobile app (front-end react native) to the google play store and app store?
How can I make it safer?
firebase firebase edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
edited Nov 12 '18 at 19:32
Frank van Puffelen
227k28372397
227k28372397
asked Nov 12 '18 at 18:10
emieldc
61
asked Nov 12 '18 at 18:10
emieldc
61
asked Nov 12 '18 at 18:10
emieldc
61
61
2
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21
add a comment |
2
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21
2
2
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21
add a comment |
1 Answer
1
active
oldest
votes
As Doug commented, the google-services.json (or google-services.plist file for iOS) does not contain any secret credentials. It merely contains the configuration data that your app needs to find its Firebase project on the servers. So sharing it with other developers on your app is not only safe, it's required for them to build an app that communicates with the same Firebase project.
You may want to consider keeping it out of version control though, and instead only deploy it onto your build server. The reason for this is not as much that that data is secret, but more that each developer should typically set up their own Firebase project for their development work. That way they won't be stepping onto each other's toes during feature development work.
Also see:
- Is it safe to expose Firebase apiKey to the public?
- Should I add the google-services.json (from Firebase) to my repository?
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53267805%2fsecurity-config-file-firebase%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As Doug commented, the google-services.json (or google-services.plist file for iOS) does not contain any secret credentials. It merely contains the configuration data that your app needs to find its Firebase project on the servers. So sharing it with other developers on your app is not only safe, it's required for them to build an app that communicates with the same Firebase project.
You may want to consider keeping it out of version control though, and instead only deploy it onto your build server. The reason for this is not as much that that data is secret, but more that each developer should typically set up their own Firebase project for their development work. That way they won't be stepping onto each other's toes during feature development work.
Also see:
- Is it safe to expose Firebase apiKey to the public?
- Should I add the google-services.json (from Firebase) to my repository?
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
add a comment |
As Doug commented, the google-services.json (or google-services.plist file for iOS) does not contain any secret credentials. It merely contains the configuration data that your app needs to find its Firebase project on the servers. So sharing it with other developers on your app is not only safe, it's required for them to build an app that communicates with the same Firebase project.
You may want to consider keeping it out of version control though, and instead only deploy it onto your build server. The reason for this is not as much that that data is secret, but more that each developer should typically set up their own Firebase project for their development work. That way they won't be stepping onto each other's toes during feature development work.
Also see:
- Is it safe to expose Firebase apiKey to the public?
- Should I add the google-services.json (from Firebase) to my repository?
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
add a comment |
As Doug commented, the google-services.json (or google-services.plist file for iOS) does not contain any secret credentials. It merely contains the configuration data that your app needs to find its Firebase project on the servers. So sharing it with other developers on your app is not only safe, it's required for them to build an app that communicates with the same Firebase project.
You may want to consider keeping it out of version control though, and instead only deploy it onto your build server. The reason for this is not as much that that data is secret, but more that each developer should typically set up their own Firebase project for their development work. That way they won't be stepping onto each other's toes during feature development work.
Also see:
- Is it safe to expose Firebase apiKey to the public?
- Should I add the google-services.json (from Firebase) to my repository?
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
As Doug commented, the google-services.json (or google-services.plist file for iOS) does not contain any secret credentials. It merely contains the configuration data that your app needs to find its Firebase project on the servers. So sharing it with other developers on your app is not only safe, it's required for them to build an app that communicates with the same Firebase project.
You may want to consider keeping it out of version control though, and instead only deploy it onto your build server. The reason for this is not as much that that data is secret, but more that each developer should typically set up their own Firebase project for their development work. That way they won't be stepping onto each other's toes during feature development work.
Also see:
- Is it safe to expose Firebase apiKey to the public?
- Should I add the google-services.json (from Firebase) to my repository?
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
answered Nov 12 '18 at 19:36
Frank van Puffelen
227k28372397
227k28372397
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53267805%2fsecurity-config-file-firebase%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
There is no private data in the Firebase config files for Android and iOS.
– Doug Stevenson
Nov 12 '18 at 18:21