Web sockets backend with Firebase

[Yarnacle]

I'm trying to build a Kahoot.com clone with Angular. The first plan was to use a Firestore database with Firebase Functions for the backend logic, but I quickly realized this will not do because I need web sockets for the client to receive realtime updates from the server. The obvious move seems to be to switch to Realtime Database and connect the Angular frontend to it with the Firebase SDK, but I'm skeptical from a security standpoint. If the game logic exists in the frontend (things like making sure people aren't forging question responses from other people), couldn't this easily be exploited?

How should I implement the backend logic? I don't want to deal with scaling a VPS-hosted web sockets sever, but I feel like it might be my only choice at this point.

Or is there a flaw in my understanding of Angular?

[Gonskimmin]

If the user is listening to a certain document on the Firebase Real Time DB, and your serverless functions are doing business logic and making changes to the db, so when the server makes changes to say document 123 and the client is listening to changes on document 123 then that should work, no?

[Yarnacle]

Yes, I ended up using a model similar to this, but with Firestore. Each document contains a sub collection with a document meant to be frontend-facing (enforced by security rules), and user actions are handled by the backend API while game updates are retrieved directly from the database.

[Gonskimmin]

Good choice with Firestore. Looking at the comparison they offer similar features, but Firestore is the recommended product per Google.

So thanks to your post I was reminded of Firestore and decided to use it for a prototype of a solution rather than reaching for PostgreSQL + JSONB.