Missing Tls in Flask with Firestore

When a Flask application communicates with Google Cloud Firestore without Transport Layer Security (TLS), credentials and data can be exposed in transit. Firestore requires secure HTTPS connections, and disabling or omitting TLS—whether accidentally or through misconfigured clients—leads to clear-text transmission of authentication tokens, project IDs, and potentially sensitive document reads/writes.

This misconfiguration often arises when developers use a custom HTTP transport or override default client settings to skip certificate verification. In such cases, an attacker on the same network or positioned between the client and Google’s endpoints can observe or tamper with requests. Because Firestore requests include authorization tokens in headers, intercepted traffic may expose these tokens, enabling account compromise or data access aligned with over-permissive IAM roles.

middleBrick scans such unauthenticated attack surfaces and flags Missing TLS as a high-severity finding under Encryption checks. Even though the scanner tests unauthenticated endpoints, any API interaction that omits TLS is flagged because tokens and query parameters can be exposed. Remediation guidance typically centers on enforcing HTTPS and validating server certificates, which aligns with findings that map to OWASP API Top 10 and compliance frameworks such as SOC2 and PCI-DSS.

To secure Flask applications using Firestore, explicitly enforce HTTPS and use the official client library, which defaults to secure TLS connections. Avoid patching the HTTP transport in a way that disables certificate validation. Below are concrete, secure patterns for initializing Firestore and making authenticated requests within Flask routes.

Secure Firestore initialization with default credentials

Initialize the Firestore client without overriding the transport. The library uses google-auth and requests under the hood and respects system CA certificates. Ensure runtime environment variables provide credentials rather than embedding them.

from flask import Flask, jsonify
from google.cloud import firestore
import os

app = Flask(__name__)

# Ensure GOOGLE_APPLICATION_CREDENTIALS points to a service account key,
# or use workload identity in production.
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = os.getenv('GOOGLE_APPLICATION_CREDENTIALS')

db = firestore.Client()  # Uses secure HTTPS by default

Explicitly require secure URLs and validate responses

When constructing any Firestore-related HTTP helpers or custom sessions, enforce https:// hostnames and verify certificates. Do not disable ssl_verify.

import requests
from flask import current_app

def get_document_secure(collection_name: str, doc_id: str):
    # Use the Firestore REST endpoint over HTTPS; never use http.
    url = f"https://firestore.googleapis.com/v1/projects/{current_app.config['GCP_PROJECT_ID']}/databases/(default)/documents/{collection_name}/{doc_id}"
    headers = {
        "Authorization": f"Bearer {current_app.config['ACCESS_TOKEN']}",
        "Content-Type": "application/json"
    }
    resp = requests.get(url, headers=headers, timeout=10, verify=True)
    resp.raise_for_status()
    return resp.json()

Flask route example with secure Firestore read

This route demonstrates retrieving a document over TLS, with structured error handling and no insecure overrides.

@app.route("/api/items/", methods=["GET"])
def get_item(item_id):
    try:
        doc = db.collection("items").document(item_id).get()
        if not doc.exists:
            return jsonify({"error": "not_found"}), 404
        return jsonify(doc.to_dict())
    except Exception as e:
        current_app.logger.error(f"Firestore read failed: {e}")
        return jsonify({"error": "internal_server_error"}), 500

CI/CD and scanning integration

With the middleBrick GitHub Action, you can fail builds when encryption findings appear, ensuring TLS issues are caught before deployment. The CLI can also be used locally to confirm remediation: middlebrick scan <url>. The Pro plan adds continuous monitoring so that any regression in encryption posture triggers alerts, while the MCP Server allows you to scan APIs directly from AI coding assistants within your IDE.