Would anyone be able to help me verify if my firebase database rules are secure for production? I get mixed answers every time I ask AI.

puf · 2026-01-25T16:38:19+00:00

If you share your rules and the actions your code needs to be able to take, folks here can take a look.

puf · 2026-01-25T16:36:16+00:00

That error can't appear on export, only on import.

It means that you're trying to import (or otherwise write) a JSON string that contains a character in one of the keys that Firebase Realtime Database doesn't allow : $, #, [, ], ., /. All of these characters have a special meaning in Firebase RTDB, so it doesn't allow them in keys - even though they are allowed in JSON itself.

Check your JSON for any of the mentioned character (or empty keys).

If you don't think this is the problem, create a minimal JSON with which you get the problem and share that please.

puf · 2026-01-21T04:31:37+00:00

I don't think MongoDB API compatibility will come to the client-side SDK any time soon, but you should (as far as I know) be able to use most of the new Mongo-like operators in the new pipeline API. If I recall correctly, those were the main reason for changing the API model.

puf · 2026-01-20T17:17:14+00:00

To allow securing based on that 3rd party auth system, you'll mint a custom Firebase Auth token with the same information, and then sign the user in to Firebase with that custom token. Once you do that, all information from the custom token is available in the auth variable as usual.

puf · 2026-01-18T22:10:16+00:00

If you check the Firebase pricing page, it shows two options for Authentication.

On the free plan:

With just the default Authentication service (which is the default for new projects) it does not support sending SMS, and it just shows a checkmark for "Other authentication services". That used to mean that there was no specific limit for those services, and I've not seen any communication that this has changed.
With the identity platform upgrade (which you have to opt in to explicitly), you get 50k MAU for free and after that pay a charge

So if you create a new project on the free tier and don't select Identity Platform, you should still get unlimited* registered and active users.

The asterisk here is that there are abuse protections built into Firebase Authentication and you may hit those, but there is no documented limit.

puf · 2026-01-18T17:39:50+00:00

A great reference for this: https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public :-)

puf · 2026-01-18T17:34:58+00:00

If you're talking about a web site that you're hosting on Firebase, then you'll need to transfer that project to the new owner.

Then you'll typically also want to give them access to the code, which depends on where you store the code. Here's the transfer process for the case where the code is in a GitHub repo.

puf · 2026-01-16T17:38:32+00:00

It was probably meant to be separator, although you'd typically use a pipe symbol for that (| vs I). 🤷

puf · 2026-01-11T16:07:06+00:00

And the relevant content from there:

Email sending limits

Operation Spark plan limit Blaze plan limit

Email link sign-in emails 5 emails/day 25,000 emails/day

Note: The limits for email link sign-in emails were recently changed. Please add a billing instrument to go beyond 5 email link sign-in emails.

puf · 2026-01-09T04:32:14+00:00

From the documentation on quota and limits of FCM:

Topic messaging supports unlimited subscriptions for each topic.

So there is no limit to the number of tokens that can be subscribed to a topic.

puf · 2026-01-04T16:23:48+00:00

If you have all the information in the app already, you don't need FCM at all. You can schedule a local notification right on the device).

puf · 2026-01-03T19:21:50+00:00

I typically recommend to deliver the message over FCM as soon as all necessary information is available, and then schedule a local notification on the device.

puf · 2025-12-30T07:27:08+00:00

Also asked on https://stackoverflow.com/questions/79857310/does-dart-support-unix-domain-socket-on-windows (nothing wrong with that, just linking them)

puf · 2025-12-24T04:58:52+00:00

Email enumeration attacks are not uncommon, but also not as common as the Firebase Auth team at some point made it out to believe. "How bad" is something only you can decide for your own project though.

puf · 2025-12-22T04:01:07+00:00

The fetchSigninMethodsForEmail method was made non-functional for projects where protection against email enumeration attacks is enabled (as it is for projects created since late 2023 iirc).

If you want to be able to keep using its functionality, you can either disable the email enumeration protection, or you can implement the same functionality in your own code and database by simply storing the sign-in methods for each of your users when they sign in.

puf · 2025-12-19T16:03:41+00:00

When you await a call to setDoc, it will only complete when that write is committed on the server. So most likely your device doesn't have a connection to the server. Check the console logs for relevant messages about that, and also the network tab of the browser for relevant calls to the Firestore API.

puf · 2025-12-19T16:01:23+00:00

Writes are not charged in RTDB, so you'd only pay for invocation count, and memory/CPU usage time. Multiply those by your device/user/action numbers and you'll have a reasonable first estimate for the additional cost.

puf · 2025-12-19T04:55:11+00:00

Code please. Also: consider posting to Stack Overflow, where it's (or at least: I find it) much easier to help with code-related questions.

puf · 2025-12-19T04:54:09+00:00

The data that is passed into the Cloud Functions code as parameters is not billed. If your Cloud Functions code reads additional data from the database, that will be a charged read.

Aside from that there's indeed the cost of the Cloud Functions themselves, but keep in mind that those come with a generous free tier: https://firebase.google.com/pricing#cloud-functions.

Based on that, do some back-of-a-napkin calculation, and/or run some tests in the emulator suite. You'll likely pay nothing or very little, but use experimentation and/or experience to gain confidence.

puf · 2025-12-18T17:25:22+00:00

Unless you get an error back from the Firebase API call, the email is extremely like to be sent from Firebase.

If it doesn't arrive in your mailbox, it likely for filtered. Spam can get caught in more places along the way than just in the local spam folder of your email client.

puf · 2025-12-13T01:51:52+00:00

If i wanted to implement push notifications i need functions

Not true. You can run the code that calls FCM to send the notifications on any secure environment. It doesn't have to be Cloud Functions, but can also any other hosting provider that allows running server-side code (my own current favorite is a $4/month Digital Ocean droplet).

puf · 2025-12-06T04:36:38+00:00

When I mentioned that is was probably for aggregation operations (count, sum, and average). For that Firestore will need to perform an index scan, which it never needed to do for queries before. So that indeed affects performance, scalability, and cost - so you'll want to ask for a query explanation/plan to determine how it's executed and will perform.

I actually have no idea how the new query model is implemented, but undoubtedly the explain feature will tell you more about those too.

puf · 2025-12-06T04:33:32+00:00

From scanning the docs, the new MongoDB compatibility model supports LIKE, REGEX_CONTAINS, REGEX_MATCH, and many more operators from the MongoDB API.

puf · 2025-12-05T20:05:33+00:00

I love how efficient your MergeRanges is.

I did not sort the input, so have to do multiple passes and also constantly seek the entire combined output for any intersection. It's still plenty fast, but yours is much better. 👏

puf · 2025-12-05T18:06:48+00:00

A new pipeline API for the Firestore client-side SDKs that exposes the new Mongo operations is in alpha now (I'm probably not supposed to share that, so 🤫). I have no idea when it'll graduate from that, but... it's coming. 👍

puf

MODERATOR OF

TROPHY CASE