I was at 3600 with many lives but the game froze :/.
Firebase 404
21–30 of 30 posts
Re: Firebase 404
#22Hi score! I'm Guest8124 with 7400. Challenge me.
Re: Firebase 404
#23Earlier quoted context omitted.
I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
Re: Firebase 404
#24Earlier quoted context omitted.
I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
You have obviously never tried Firebase.
Re: Firebase 404
#25Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
Aha! My only use of firebase was writing a chat application for fun back at their launch marketing push. This is good to see, and I think I might go play with it more.
Re: Firebase 404
#26Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
I still don't see how setting security rules would prevent cheating. I would love to know how to fix this issue as I'm making a similar MMO game with Firebase.
Re: Firebase 404
#27Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
[deleted]
Re: Firebase 404
#28Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
[deleted]
Re: Firebase 404
#29Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html
[deleted]
Re: Firebase 404
#30Earlier quoted context omitted.
well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.
You have obviously never tried Firebase.
So how would you prevent people from just setting whatever score they want in this game?