Broken Authentication in Fiber with Firestore

Broken Authentication in a Fiber application that uses Firestore as the backend typically arises from weak session handling, missing or misconfigured security rules, and insecure direct object references (IDOR). When authentication logic relies solely on client-side state or predictable identifiers, an attacker can manipulate session tokens or user IDs to access other users' data stored in Firestore.

Firestore security rules are central to protecting user data. If rules are not scoped to the authenticated user and do not enforce ownership checks, a compromised or predictable user ID can lead to unauthorized reads and writes. For example, a route like /users/:uid/profile that directly maps the URL parameter to a Firestore document path without validating that the authenticated user matches :uid enables BOLA/IDOR.

Additionally, missing or weak session management in Fiber — such as not regenerating session identifiers after login, storing sensitive data in cookies without the HttpOnly and Secure flags, or failing to enforce HTTPS — can expose authentication tokens to interception or reuse. MiddleBrick scans test these vectors by probing endpoints without credentials and analyzing how authentication requirements are enforced across the API surface.

Firestore-specific risks include misconfigured rules that allow broad read or write access, use of admin SDK privileges in endpoint logic, and exposure of user enumeration via timing differences or error messages. An attacker may attempt to enumerate valid user IDs by observing differences in response behavior, then use those IDs to access other users' documents. The combination of Fiber routes that expose identifiers and Firestore rules that do not properly constrain access amplifies the impact of weak authentication controls.

To remediate broken authentication when using Fiber with Firestore, enforce strict ownership checks, use secure session management, and apply least-privilege Firestore rules. Always validate that the authenticated user matches the requested resource owner, and avoid exposing internal identifiers directly in URLs.

Secure session handling and user mapping

Use a session or token mechanism that binds authentication to the user's Firestore document ID without exposing it in predictable routes. MiddleBrick can detect weak session configurations and missing CSRF protections during scans.

package main

import (
	"context"
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/session"
	"firebase.google.com/go/v4"
	"firebase.google.com/go/v4/db" // Firestore client via Firebase Admin
	"google.golang.org/api/option"
)

func getCurrentUserID(c *fiber.Ctx) (string, error) {
	sess, err := session.Get(c)
	if err != nil || sess.Get("userID") == nil {
		return "", fiber.ErrUnauthorized
	}
	return sess.Get("userID").(string), nil
}

func GetProfile(c *fiber.Ctx) error {
	ctx := context.Background()
	opt := option.WithCredentialsFile("service-account.json")
	app, err := firebase.NewApp(ctx, nil, opt)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to initialize Firebase"})
	}
	client, err := app.App(ctx).Firestore(ctx)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to get Firestore client"})
	}

	userID, err := getCurrentUserID(c)
	if err != nil {
		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized"})
	}

	// Scope read to the authenticated user's document
	docRef := client.Collection("users").Doc(userID)
	doc, err := docRef.Get(ctx)
	if err != nil || !doc.Exists() {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "profile not found"})
	}
	return c.JSON(doc.Data())
}

Firestore security rules to enforce ownership

Define rules that ensure users can only access their own documents. Use request.auth to validate UIDs and avoid wildcards that permit broad access.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    // Deny public access to sensitive collections
    match /privateData/{docId} {
      allow read, write: if request.auth != null && request.auth.uid == request.resource.data.userId;
    }
  }
}

Rate limiting and account enumeration protection

Implement rate limiting on authentication endpoints to mitigate credential stuffing and enumeration attacks. Avoid leaking information through error messages by using consistent responses for invalid usernames or passwords.

func Login(c *fiber.Ctx) error {
	// Validate credentials, use constant-time comparison where applicable
	// Always return the same generic error message to prevent enumeration
	return c.JSON(fiber.Map{"message": "Invalid credentials"})
}

MiddleBrick scans verify that authentication controls are consistently applied and that Firestore rules align with runtime behavior. The scans highlight findings mapped to frameworks such as OWASP API Top 10 and provide prioritized remediation guidance.