javascript - 了解 Firebase 应用初始化的安全性

Question

这个问题已经有答案了:

Is it safe to expose Firebase apiKey to the public? (10 个回答)

已关闭 3 年前。

我正在尝试创建一个博览会应用程序，而不使用服务器作为前端和 Firestore 之间的中间人。通过firestore quickstart ref和 expo firestore quickstart (见底部)，它表示通过将 API key 传递给以下函数来初始化 Cloud Firestore 应用程序:

// Initialize Cloud Firestore through Firebase
firebase.initializeApp({
  apiKey: '### FIREBASE API KEY ###',
  authDomain: '### FIREBASE AUTH DOMAIN ###',
  projectId: '### CLOUD FIRESTORE PROJECT ID ###'
});

var db = firebase.firestore();

但是此 JavaScript 代码将在客户端运行。这不会向用户公开您的 API key 吗？

Answer 1

来自 google firebase 文档:

The content is considered public, including your platform-specific ID (entered in the Firebase console setup workflow) and values that are specific to your Firebase project, like your API Key, Realtime Database URL, and Storage bucket name. Given this, use security rules to protect your data and files

您可以阅读更多here