Firebase authentication exposes firebaseAuthToken, is it secure?
angularfire, angularjs, firebase, firebase-security, firebasesimplelogin
Solution
This is fundamentally a question about OAuth and how it operates. The generation of an encrypted token is fundamental to this process. There are plenty of opinions on whether and where it is okay to store this token (cookies, local storage, memory, etc).
Is a token secure? When utilized over an SSL session, OAuth is quite secure. Firebase utilizes the same OAuth practices and encryptions that the other big names, all of whom provide OAuth tokens in a similar manner (in fact, in Simple Login, you can obtain your Facebook auth token, for instance, as part of the login payload, exactly as it's given to us via Facebook's API).
That's not to say that OAuth is without its warts. There is no perfect answer in security since everything is a trade-off. The only completely secure system is the one that doesn't exist physically, isn't connected to any network, and can't be accessed by human beings.
Regarding XSS, etc: In essence, once the trolls are in the castle, the china is going to get broken. If the client is compromised, then nothing is secure. If a user manages to somehow compromise your client's browser or execute a successful XSS, then they can gain access to your account by a number of ways, regardless of whether we're talking OAuth tokens or plain login/password fields.
In summary, if you trust Google, Facebook, Twitter, Yahoo, and M$ authentication to be relatively secure, then you can have the same faith in the Firebase authentication schema.
Problem
I'm trying to provide Google Login for my Firebase application. Following https://www.firebase.com/docs/security/simple-login-overview.html It appears that after a successful login, a user can be obtained, hence it could be for example stored in the Angular scope - e.g. $scope.loggedInUser. (Depending on your implementation, it doesn't have to be Angular) My question is, is it a security risk that the user returned by Firebase with lots of authentication tokens can be exposed? The code is in Javascript, somehow hackers should be able to hijack and steal the user by embedding some code in a browser. The bits that raise my concern are: accessToken, firebaseAuthToken If it is a risk, how can we secure it? Please refer to the code below for authentication and user data: Here's the code for authentication: ``` authModule.controller( 'AuthController', [ '$scope', '$firebase', function ( $scope, $firebase ) { var ref = new Firebase( 'https://test123.firebaseio.com' ); var auth = new FirebaseSimpleLogin( ref, function ( error, user ) { if ( user ) { $scope.loggedInUser = user; // user has authenticated, this user contains security information } } ); $scope.login = function () { auth.login( "google", { scope: 'https://www.googleapis.com/auth/plus.login' } ); }; }] ); ``` What's contained in loggedInUser (this is just example data): ``` loggedInUser: { id: 7058267704789236427849 uid: google:7058267704789236427849 displayName: Joe Bloggs provider: google thirdPartyUserData: { id: 709139364278942374 email: test@gmail.com verified_email: true name: Joe Bloggs given_name: Joe family_name: Bloggs link: https://plus.google.com/2672340913423423 picture: https://lh3.googleusercontent.com/.../photo.jpg gender: male locale: en-GB } accessToken: W8k8dD6vvLEdlWa-dxkJD8lvWIwzea6m_86um8... email: test@gmail.com firebaseAuthToken: Q3Mjc4MzYsInYiOjAsImQiOnsiaWQiOiIxMDk0... } ```