Security Issues

[lopezjuanma96]

before deploying the first version of the app publicly, we must review some security issues, the main objective being not letting a connection between some data and a user's email.

[lopezjuanma96]

ToDo:

• Review Cross-Origin Resource Sharing (CORS) so that only keyboard requests are allowed for learn and predict.
• Review Firebase Rules to allow read, write actions based on users, only we should be able to delete data, users should be able to get data (only as predictions) and writing data should be allowed for users on their cache and for us on the general models.
• Is it necessary to authenticate each request with the user's ID? Maybe not if CORS are well implemented.

[lopezjuanma96]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[lopezjuanma96]

https://firebase.google.com/docs/rules/rules-language

It's still not clearly defined where we'll save the users data (probably on Realtime Database), but for now the structure of the firebase rules would be looking something like this:

service cloud.firestore {
match /databases/{database}/documents/{document} {
//here should add if request.auth.id is from a list of authorized users to write databases
allow write: if false;

//for searching databases of models (should check for something in the name of the document or database)
allow read: if 'rule-string' in database;

//for searching databases of users (this might go to the Realtime Database rules)
allow read: if request.auth != null; //&& request.auth.uid == userId;
}
}

[hectoritr]

@lopezjuanma96 es this done?