Firebase - restrict API key for web application

Question

I just got a mail from the Firebase support that my current API key restrictions for the Firebase API key lead to malfunctions for the Firebase Installation API. Since, I have a web application and not an iOS or an Android app, I′m assuming that this is not a real issue for me at the moment.

However, this got me wondering if I enabled all necessary HTTP referrers (websites) in the Google Cloud Platform to ensure a working environment for my web application. Let′s say my domain is called www.domain.com and my Firebase project is called projectx. I currently have these two entries in the HTTP referrers for the Application restrictions:

• www.domain.com/*
• projectx.firebaseapp.com/*

Is there anything else I should enable? Because I saw that Firebase also enables multiple domains such as projectx.web.app by default.

question from:https://stackoverflow.com/questions/65903955/firebase-restrict-api-key-for-web-application

Answer 1

It's fairly simple: you need to enable the domains that your app uses.

The two domains you have are the defaults for cases where you have a common domain:

• www.yourdomain.com/* is the custom domain that you typically share out with people.
• projectx.firebaseapp.com is the default domain generated by Firebase, and is typically also used in sign-in screens (although you can change this).

You may also want to add:

• projectx.web.app, which is a newer default domain that Firebase creates. But this is not required, so only add it if you expect to hand it out to folks.
• localhost, which is handy for local testing