英文:
Difference between authorizing the user and allowing the controls
问题
我正在建设一个应用程序，来自非计算机科学背景，但找不到以下两种情况之间的关键区别。假设 Activity X 应该得到保护，并且只对授权人员开放。
- 情景。用户输入凭据，如果凭据正确，将被重定向到 activity X，这些凭据存储在 Firebase 身份验证 中，他现在可以完成所需的工作，如果他现在按下注销，则再次使用 Firebase 身份验证 注销并发送到主页面。[我正在使用 Firebase 身份验证进行此操作]
- 情景。用户输入凭据，如果凭据正确，将被重定向到 activity X（这些凭据与 Firebase 实时数据库中的现有实体匹配），他现在可以完成所需的工作，如果他现在按下注销按钮，则将被重定向到主页面。
在这两种情景下，我觉得只有用户知道正确的凭据才能访问活动 X，但我也认为 情景 2 不是正确的做法。你能解释一下情景 2 中的安全问题和陷阱吗？
问候。请分享你的想法，社区成员。
英文:
I am building an app and come from a non-cs background but can't find a crucial difference between the following two scenarios. Assume Activity X is to be made secure and available only for authorized people.
- Scenario. The user enters the credentials and he/she is directed to activity X if the credentials are correct, which are stored in firebase authentication, he can now do the work required and if he presses the Logout now, then he/she is logged out again using firebase authentication and sent to the main page. [I am using firebase authentication for this]
- Scenario. The user enters the credentials and he/she is directed to the activity X if the credentials are correct (these credentials are matched for existing entities in the firebase real-time database), he can now do the work required and if he presses the Logout button now, then he/she is redirected to the main page.
In both scenarios, I feel that only if the user knows the correct credentials he/she can access activity X, but I also think that Scenario 2 is not the correct way to do so. Can you explain the security issues and pitfalls in scenario 2?
Regards. Please share your thoughts, members of the community.
答案1
得分: 2
-
这绝对是你可以为用户实施的最简单和最安全的解决方案。一旦你实施了 Firebase 认证，你就可以为可能使用的其他产品（Firestore、实时数据库和云存储）设置安全规则。
-
在实时数据库中存储用户凭据可能被视为一种风险。没有认证，你就不能编写安全规则。这意味着任何知道你项目 ID 的人都可以读取和写入你的数据库。
所以我强烈建议继续使用第一种选项。由于你标记了你的问题为 [tag:android]，我建议查阅一些额外的资源：
或者：
英文:
-
That's by far the simplest and most secure solution you can implement for your users. As soon as you implement Firebase Authentication, you can then set security rules for the other products that might use, Firestore, Realtime Database, and Cloud Storage.
-
Storing user credentials in Realtime Database can be considered a risk. Without authentication, you cannot write security rules. This means that anyone that knows your project ID can read and write data in your databases.
So I definitely recommend going ahead using option one. Since you tagged your question with [tag:android], then I recommend checking some additional resources:
Or:
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论