security/spam.... how to limit only certain domain can submit data to firebase? about angularfire HOT 4 CLOSED

I'm also interested in knowing the answer; the Forge provides a place to configure authorized request origins, but you cannot exclude localhost and 127.0.0.1 and that looks like a security threat to me.

from angularfire.

This isn't a security threat. Although it might appear that allowing localhost would allow someone to create a local file and get around the authorized domain restriction, this is actually true of any domain. You can spoof local DNS or hack a browser, etc. to get around the authorized domain restriction.

That restriction is not there to prevent determined hackers from logging in from the wrong domain. It's there to prevent hackers from tricking other people into authenticating from the wrong domain.

from angularfire.

@startupandrew So if that is not a security threat, how do I prevent people who have acquired or guessed my Firebase URL from accessing and modifying my data?

from angularfire.

You should use the Firebase Security Rules. There's a screencast that will guide you through it here:
https://www.firebase.com/docs/security-quickstart.html

from angularfire.