Firebase可以提供部分基于私钥/值对的动态值吗？ [英] Can Firebase provide a dynamic value based in part from a private key/value pair?

问题描述

是否可以使用私有Firebase键/值对动态计算数据？

以下是我正在努力完成的工作 -

在Firebase中，我希望将我的AWS用户凭据存储为键/值对，例如AWS_ACCESS_ID =值。 （我不希望我的用户有权访问此密钥）。然后，我希望有一个Web浏览器（通过Firebase使用Javascript）读取一个单独的键/值对，其值部分来自私人AWS_ACCESS_ID键。我不能让我的客户端先读取AWS_ACCESS_ID关键字b / c，然后将它公开。

换句话说，一个公开暴露的值是从一个私有值。这是可能的使用Firebase？

解决方案

Firebase没有计算值的概念，因为您在这里描述它们。安全规则允许你声明性地做（可能相当复杂的）验证。但Firebase不提供在服务器上运行代码的能力来计算派生值。

最接近的是通过运行计算密钥的代码一个你自己的服务器。这有助于认识到服务器在这里有点不恰当。您可以通过在本地机器上的node.js进程中运行此类代码，甚至在浏览器选项卡中轻松开始。

重要的是这段代码运行在提升的权利，这只是意味着它要么使用您创建的特殊管理员帐户，要么使用所谓的秘密您的Firebase的信息中心。随着代码可以访问所有数据的秘密，所以你可以拒绝来自普通用户的密钥对。

Is it possible to calculate data dynamically using private Firebase key/value pairs?

Here's what I'm trying to accomplish -

Within Firebase, I'd like to have my AWS user credential stored as a key/value pair, e.g. AWS_ACCESS_ID = value. (I don't want my users having access to this key.) I'd then like to have a web browser (using Javascript via Firebase) read a separate key/value pair that determines its value based in part from the private AWS_ACCESS_ID key. I can't have my client first read the AWS_ACCESS_ID key b/c it would then be exposed.

In other words, a publicly exposed value is determined from a private value. Is this possible using Firebase?

解决方案

Firebase doesn't have the concept of calculated values as you describe them here. The security rules allow you to declaratively do (possibly quite complex) validations. But Firebase doesn't offer the ability to run your code on their servers to calculate derived values.

The closest you can get is by running the code that calculates the key on a server of your own. It helps to realize that "server" is a bit of a misnomer here. You can easily get started by running such code in a node.js process on your local machine or even in a browser tab.

The important thing is that this code runs under elevated rights, which simply means that it either uses a special "administrator" account that you created or (more likely) using the so-called secret that you can find in the dashboard of your Firebase. With the secret that code has access to all data, so you can then deny access to the keypair from regular users.

这篇关于Firebase可以提供部分基于私钥/值对的动态值吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！