Google Professional Cloud Developer Question 448
Single answerGoogle Cloud PlatformYou are developing a RESTful API for your application using Google Cloud's API Gateway. The API fetches user data from a Cloud Firestore database. For security purposes, you need to restrict the data returned by the API so that each user can only see their own profile information. What is the best approach to achieve this?
- A
Use Firebase Authentication to retrieve the user's ID token and filter the Firestore query using this token.
- B
Apply a Firestore security rule that checks if the requesting user's ID matches the document's owner field.
- C
Write a custom filter in your client-side code to hide data unrelated to the authenticated user.
- D
Add a query parameter to the API request that specifies the user ID to fetch, and use it to filter the Firestore query.
Show answer and explanation
Correct answer: B
Explanation
Restricting returned data should be handled at the source (Firestore) level to ensure security. Firestore security rules are specifically designed to enforce access control and are independent of API or client-side logic. This ensures that only authorized users can access their own data, even in cases of API misconfiguration or malicious client behavior. While other options may partially solve the problem, only Firestore security rules provide a robust and secure solution.
- A. Incorrect.
While Firebase Authentication can validate the user's identity, using it alone does not restrict the data returned by the API. You still need to enforce access control rules in Firestore.
- B. Correct.
Applying Firestore security rules ensures that only authorized data is returned by Firestore queries, even if the API or client-side logic is compromised. This is the most secure and recommended approach.
- C. Incorrect.
Client-side filtering is insecure because it exposes all the data to the client and relies on the client to enforce access control. This approach violates best practices.
- D. Incorrect.
Using a query parameter to filter on user ID is insecure unless additional measures (such as Firestore security rules) are in place to enforce access restrictions. Query parameters alone do not guarantee data security.