Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Fire Safety: Secure Your Firebase Data

Fire Safety: Secure Your Firebase Data

GDG London - Android and Firebase Security talks - Sep 2018

Avatar for Kaan Mamikoglu

Kaan Mamikoglu

September 10, 2018

Other Decks in Technology

Transcript

  1. Fire Safety GDG London - Android & Firebase Security Talks

    Kaan Mamikoglu Mobile Software Engineer @ MyDrive Solutions GDG London Lead @kaanmamikoglu | iamkaan.com
  2. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authentication ɔːθɛntɪˈkeɪʃ(ə)n/ noun

    noun: authentication; plural noun: authentications the process or action of proving or showing something to be true, genuine, or valid. COMPUTING the process or action of verifying the identity of a user or process.
  3. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization (Authorisation? )

    ɔːθərʌɪˈzeɪʃ(ə)n/ Noun the action of authorizing. a document giving official permission.
  4. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization now root

    newData data $ variables auth Default Variables
  5. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization { "sessions":

    { "somerandomsessionid": { "title": "Fire Safety", "description": "Fire safety is the set of practices intended to reduce the destruction caused by fire. Fire safety measures include those that are intended to prevent ignition of an uncontrolled fire, and those that are used to limit the development and effects of a fire after it starts.", "start_time": "18:50", "end_time": "19:20" }, ... } }
  6. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization { "rules":

    { ".read": "auth != null", ".write": "auth != null" } }
  7. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization { "babies":

    { "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { "google": "gogo", "phone": "phos", "peppa": "peppa", "crocodile": "croco", ... }, "parents": { "cXuBkCQuV2YX7vW2HA4dbc2cNyC2": "Mother", "FzDkcwhMQ4eOVj3LfKokitXS6mZ2": "Father" } }, ... } }
  8. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization { "babies":

    { "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { "google": "gogo", "phone": "phos", "peppa": "peppa", "crocodile": "croco", ... }, "parents": { "cXuBkCQuV2YX7vW2HA4dbc2cNyC2": "Mother", "FzDkcwhMQ4eOVj3LfKokitXS6mZ2": "Father" } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby
  9. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby Authorization
  10. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby Authorization
  11. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { ".read": true, ".write": true } } Authorization babies/somerandomidforemily/name auth
  12. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { ".read": "auth != null", ".write": "auth != null" } } Authorization Using auth variable babies/somerandomidforemily/name auth
  13. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { ".read": "auth != null", ".write": "auth != null" } } Authorization Using auth variable babies/somerandomidforemily/name auth
  14. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { ".read": false, ".write": false } } Authorization babies/somerandomidforemily/name auth
  15. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { } } Authorization babies/somerandomidforemily/name auth
  16. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "somerandomidforemily": { ".read": true } } } } Authorization babies/somerandomidforemily/name auth
  17. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { ".read": true } } } } Authorization Wildcard path ($) babies/somerandomidforemily/name auth
  18. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { ".read": true "words": { ".read": "auth != null && data.parent().child('age_in_months').val() > 24" } } } } } Authorization Referencing data babies/somerandomidforemily/words auth
  19. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { ".read": true "words": { ".read": "auth != null && data.parent().child('age_in_months').val() > 24" } } } } } Authorization Rules Cascade babies/somerandomidforemily/words auth
  20. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { }, "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { ".read": true "words": { ".read": "auth != null && data.parent().child('age_in_months').val() > 24" } } } } } Authorization Rules Cascade babies/somerandomidforemily/words auth
  21. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { }, "name": "Emily", "age_in_months": 21, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('age_in_months').val() > 24" } } } } } Authorization babies/somerandomidforemily/words auth
  22. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" } } } } } Authorization babies/somerandomidforemily/words auth
  23. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" } } } } } Authorization babies/somerandomidforemily/info/name auth
  24. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" } } } } } Authorization babies/somerandomidforemily/words auth
  25. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" ".write": "data.parent().child('parents').hasChild(auth.uid)" } } } } } Authorization Write > babies/somerandomidforemily/words auth
  26. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" ".write": "data.parent().child('parents').hasChild(auth.uid)" } } } } } Authorization Write > babies/somerandomidforemily/words auth
  27. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" ".write": "data.parent().child('parents').hasChild(auth.uid)" } } } } } Authorization Write > babies/somerandomidforemily/words parent auth
  28. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" ".write": "data.parent().child('parents').hasChild(auth.uid)" } } } } } Authorization babies/somerandomidforemily/words parent auth
  29. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby { "rules": { "babies": { "$baby": { ".read": "data.child('parents').hasChild(auth.uid)" "info": { ".read": true }, "words": { ".read": "auth != null && data.parent().child('info').child('age_in_months').val() > 24" ".write": "data.parent().child('parents').hasChild(auth.uid)" } } } } } Authorization babies/somerandomidforemily/words parent auth
  30. Fire Safety GDG London @kaanmamikoglu | iamkaan.com { "babies": {

    "somerandomidforemily": { "info": { "name": "Emily", "age_in_months": 21 }, "words": { … }, "parents": { … } }, ... } } Everybody can see Name Age All authenticated users can see only if the baby is over 2yo Words Parents can modify Words * Parents can see all info on their baby Authorization .validate ".validate": "newData.val().matches('some(Regex)*')" ".validate": "newData.isBoolean()" ".validate": "newData.val().contains('o')" ".validate": "newData.hasChildren(['some', children'])"
  31. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization service cloud.firestore

    { match /databases/{database}/documents { match babies/{babyId} { function age() { return get(/databases/$(database)/documents/babies/$(babyId)).data.age_in_months; } function isParent() { return exists(/databases/$(database)/documents/babies/$(babyId)/parents/$(request.auth.uid)); } allow read; match /words/{word} { allow read: if request.auth != null && age() > 20; allow write, update, delete: if isParent(); } } } }
  32. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization service firebase.storage

    { match /b/{bucket}/o { match /{allPaths=**} { allow read, write; } } }
  33. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization service firebase.storage

    { match /b/{bucket}/o { match /{allPaths=**} { allow read, write: if request.auth != null; } } }
  34. Fire Safety GDG London @kaanmamikoglu | iamkaan.com Authorization function isCurrentBaby(babyId)

    { return request.auth.uid == babyId; } service firebase.storage { match /b/{bucket}/o { match /babies/{babyId}/{fileName} { allow read, write: if isCurrentBaby(babyId); } } }
  35. Thank you! Kaan Mamikoglu Mobile Software Engineer @ MyDrive Solutions

    GDG London Lead @kaanmamikoglu | iamkaan.com