Subvert Firebase Authentication


Use  Firebase: One Authenticated User for Multi User Logins with App Inventor


I am not saying you should do this, there are perhaps only a few use cases for doing this, but because it can be done I had a go at doing it.

When developing or testing with a Firebase Realtime Database project, you can start off with no security rules, but it very soon becomes clear that you need to have some security rules in place, to protect your users data, control who has access to your project, and to stop the pesky alerts from Firebase about security issues. It may be however, that you have a use case that really does not need all the bells and whistles provided by Firebase security and authentication, you could have an app you have built for family, friends or trusted users, or you want to have more control over who can do what from within your app, as opposed to the server side.

Why not, therefore, connect your app to your firebase project with just a single authenticated user, for all the users of your app? It is your app that is the authenticated user, not the person using the app. I did a google search for this which returned a Stackoverflow question on the very subject. The Firebase guru Doug Stevenson says it is possible to do this. If he says so, then why not.

I hope to show how you set up the initial authentication in Firebase, along with the security rules required, then how to create a signUp/SignIn system within the app, using your firebase, for all your users, and finally some methods for the storage and retrieval of data created by users, much along the lines of how you might set things up for normal authenticated users. The key, of course, is in keeping your single authenticated user details close to your chest. You will note that I am not using any of the built-in Firebase components or extensions available for Firebase, just the web component and the Firebase Web REST api. You can learn all about that here

SETUP Firebase Authentication


App Inventor App

That is it for the first part, your app is now connected by your single authenticating user, with security rules in place, to your Firebase realtime database, in the bucket FOAUMLU (only), with read and write capabilities. Any user of your app can use this (but, for the moment, there is nothing they can do!). Your app should be displaying a blank screen ;)

SETUP User SignUp/SignIn System (susi)

App Inventor App

This is the stage for setting up users in your app, once the app has connected to firebase.  The entire susi system is setup and controlled in the app Inventor app. All user info is stored on and retrieved from Firebase. The only validation checks I have included is for duplicate usernames and an incorrect password. We will create a node below the projectBucket FAOUMLU called users, and each signed up user's details will be recorded within. No signed in user will be able to read the data in users, however the app will be able to, in order to susi a user.

SETUP Storing and Retrieving Data

Let us first explore the web component url which will set how our users can store and retrieve data. This assumes we will set in stone any user requests in the blocks to a certain point in the data structure.


This structure would be used where all users can read and write to all data. The "base" node is /FOAUMLU/data and the user would be able to create the node animal with the value pig. Any use could overwrite this element

This structure would be used when a user, let us call them user1, can only write to their own area. The base node here is, for example: /FOAUMLU/data/user1. They can create the node animal with the value pig, but only they will be able to overwrite it. depending on the read data settings, other may be able to see it.


Here we see how we would call back the data value for animal when all data is readable. If you wanted to return all the data, then simply remove the join / animal block

Here we see how to retrieve the data when only the user can access their own data


single node with a value

a "Firebase" list (the numbers: 0,1 etc. are automatically generated for you)

An "AI2" list

A "Firebase" list with identified nodes

A timestamp in milliseconds since epoch using the built-in timestamp feature in Firebase

you can replace a list like this...

with a list like this

As you will see, there are two more web components to add, one named Web4StoreData, the other Web5GetData.

The storeData procedure will look like this:

The getData procedure will look like this:

Both generate a responseContent of a JSON string/list which must be handled with the .JsonTextDecode block to covert to an "AI2" list or element


Download a blank AIA FILE of this project

This is setup to run for users to only have access to their own data. To create this with your own settings, you will need to follow the first part of this guide in order to provide: