Firebase Hosting - password protection site?

Question

I just deployed a site for Firebase hosting, and it works great - the setup was very simple.

My question, however, is that can I make access to the website limited to authentication? This is the admin panel with which only my team should have access. Is there a way to password protect or privatize my site hosted on Firebase?

Thanks!

Answer 1

This is currently not possible, although this was a popular feature request. We have some ideas on how we could do something similar, but not yet announce anything.

Answer 2

Late in the evening, but I encountered a similar problem when I wanted to create a dashboard accessible only to users of our domain (but did not want to manage individual accounts).

The use of the standard Google authorization stream has been completed, but restricting access to data through database rules. To check whether the user is authorized, we try to access the data immediately after logging in (and before we inform the user). If this fails due to authorization, our user is an outsider.

Firebase DB Rule:

{ "rules": { ".read": "auth.token.email_verified == true && auth.token.email.matches(/.*@ourdomain.org$/)", ".write": false } } 

see https://firebase.google.com/docs/reference/security/database/

Note: this has definitely become easier due to the fact that our organization runs our mail through gsuite, however you can easily define more detailed rules when this option is not available.

Answer 3

The easiest way to solve this problem for me was to transfer my application from Firebase to AWS Amplify. This allows you to protect the application with a password. Under access control, change it from "Public Viewing" to "Limited". If you are looking for a feature that is similar but, in my opinion, more reliable than Firebase authentication, then integrate AWS cognito into your application; With AWS Cognito, you can prevent new users from registering and restrict email from new users to specific domains, including other features.