March 2019 Summaries

Firebase Realtime Database introduced improved support for large-scale data deletion through Firebase CLI version 6.4.0 and later, which detects large nodes and removes them in chunks to reduce capacity strain. Because chunked deletion can temporarily expose partially deleted data and does not block new writes at the affected path, applications with active listeners may need to handle incomplete states; systems requiring immediate consistency can instead use tombstone fields to hide records before asynchronously purging them with scheduled Cloud Functions and access rules. The update also adds the defaultWriteSizeLimit configuration, which prevents oversized writes or deletes based on estimated execution times, with small, medium, large, and unlimited thresholds, plus a REST-only tiny option. New databases default to the large threshold, while existing databases initially retain unlimited limits, though Firebase planned to shift eligible existing databases to large during summer 2019 and encouraged developers to configure protections proactively.

Firebase Crashlytics displays up to the latest 100 app versions by default, so frequent debug and CI/CD builds can crowd out production releases from version filtering. To preserve visibility into important production builds, crash reporting can be disabled for debug variants on both iOS and Android. For manually initialized Fabric-based apps, developers can conditionally omit Crashlytics initialization using DEBUG checks in Swift, Objective-C, or Android’s BuildConfig.DEBUG flag. For automatically initialized Firebase Crashlytics apps, collection can be disabled through the firebase_crashlytics_collection_enabled setting in iOS Info.plist files or Android manifest metadata, including variant-specific debug manifests for more targeted control.

Firebase Authentication has added Microsoft and Yahoo as federated identity providers, allowing applications to support these sign-in options without managing custom backend credentials. The update also introduces generic OAuth 2.0 provider sign-in, which uses web-based authentication flows through Chrome Custom Tabs on Android and Safari View Controllers on iOS to obtain provider credentials and complete Firebase sign-in. This approach can reduce application size by eliminating the need for provider-specific client SDKs, simplify setup through a consistent implementation model, and create a more unified user experience across providers. Generic sign-in is initially available for Microsoft and Yahoo, with plans to extend it to additional identity providers, and Firebase provides platform-specific setup guides and quickstarts for iOS, Android, and web applications.

Cloud Firestore introduced the `FieldValue.increment` operation, allowing applications to atomically increase or decrease numeric document fields directly on the server without requiring a transaction for simple counter updates. The feature prevents concurrent writes from overwriting one another, such as when multiple users add step totals to a shared fitness-team counter at the same time, and it also works in situations where transactions are less suitable, including offline use. Transactions remain necessary when updates require conditional logic, such as enforcing minimum or maximum values. Developers should also account for Firestore’s sustained limit of one write per second per document and use distributed counters for more frequently updated values.

Firebase announced several game-development updates at the Game Developers Conference in San Francisco, including Crashlytics support for Unity, open-sourcing its C++ SDKs, AI-assisted Monkey Actions for Android game testing, and Game Center authentication support for iOS. Crashlytics for Unity provides real-time crash reporting, diagnostic breadcrumbs, integrations with services such as Slack and Jira, and BigQuery exports for deeper analysis of issues by custom attributes such as game level. The open-source C++ SDK gives developers greater visibility and control over Firebase integrations, including the ability to customize code, maintain branches, and extend platform support. AI-assisted Monkey Actions in Firebase Test Lab are designed to navigate game interfaces more efficiently than random taps, reducing the example time to start a game from about 35 seconds to 13 seconds. Firebase Authentication can now let iOS players signed into Game Center access games without an additional sign-in process, and Firebase invited GDC attendees to visit its booth and cloud-development session for further information.

Firebase security rules govern client access to Realtime Database, Cloud Storage, and Cloud Firestore by enforcing authentication-based authorization, data validation, and application logic, while the Firebase Admin SDK operates with service-account privileges that bypass those rules and must therefore run only in trusted backend environments. The discussion recommends using restrictive rules to keep application-managed data read-only for users, then updating it through trusted services such as Cloud Functions; implementing role-based access through Firebase Authentication custom claims; and withholding sensitive records with visibility fields until backend processes release them. It also cautions that overlapping Firestore rule matches are permissive if any applicable rule allows access, encouraging narrowly scoped rules rather than broad wildcards. Administrative tasks such as backups and data deletion should use the Admin SDK instead of weakening client rules, while dynamic access control lists can block or later restore user access through backend-managed documents. By separating security policies from application code, Firebase allows developers to update protections quickly while combining strict client-side constraints with flexible server-side operations.

Firebase has implemented Certificate Transparency for its Realtime Database to strengthen SSL/TLS security and help detect certificates mistakenly or maliciously issued by certificate authorities. Realtime Database responses will now always include a Signed Certificate Timestamp, extending protection to every user connection rather than only to browsers that request it. Although the added certificate data slightly increases response sizes and could produce a small rise in billed outbound bandwidth costs, Firebase presents the change as an important safeguard for applications and users against rare but serious certificate-related attacks.