python-firebase requires your Firebase Secret to be embedded in code? about python-firebase HOT 2 CLOSED

If you could confirm that my understanding is right, I can give you a Pull Request which allows the use of a token without using the secret.

from python-firebase.

Got this back from the firebase guys, so I guess this is apparently OK as long as your server is trusted.

"It's fine (and expected) to use your Firebase Secret in your trusted server code. You just shouldn't put it anywhere that gets sent to the user (in your html / javascript, in a mobile app, etc.).

It's not as applicable to the python client, since most of the code you write in python is probably trusted server code, so it's fine to include the secret. But for our other token generators (java, javascript, etc.) we've had issues with people accidentally leaking their secret by improperly using it in code that gets sent to their users."

But I still don't like the idea :) So I've made a couple of mods to your code which allow me to use a more fine-grained role-specific token-based approach. I'll send in a Pull Request with the changes.

from python-firebase.