January 2021 Summaries

Firebase Extensions provide pre-packaged, Firebase and Google Cloud-based features that developers can install through the Firebase console or command line to handle common tasks such as image resizing, email notifications, text translation, URL shortening, payment processing, and invoicing. Alongside officially tested extensions, Firebase introduced Experimental Extensions, which are functional community-feedback-focused tools with less testing and polish, including options for Dynamic Links shortening, Firestore sentiment analysis, custom Firebase Auth claims, and scheduled Firestore writes. Experimental extensions can be installed from their GitHub repository or with Firebase CLI commands, and developers can submit feedback through GitHub issues or contribute improvements through the Alpha program. Firebase also announced Community Extensions, allowing approved Alpha-program Extension Publishers to build and share their own extensions with other Alpha members, with broader public sharing planned for the future.

Firebase’s Crashlytics team created its first comic, featuring the Great Crash Detective, to illustrate how developers can investigate mobile app crashes and the events leading up to them. The project was inspired by a developer who wanted to search custom crash logs but lacked the time to learn SQL, despite Crashlytics supporting BigQuery exports, including real-time exports, for detailed data analysis. The team highlighted Google Data Studio as an accessible alternative for visualizing BigQuery crash data through a customizable template. By adding an advanced filter on the “Crashes by File” report page and setting its control field to `logs.message`, developers can search crash datasets for custom log events, with similar filtering available for fields such as analytics breadcrumbs. The post invites feedback on future Firebase comics and on using Crashlytics with BigQuery and Data Studio.

Firebase Security Rules for Firestore, Storage, and Realtime Database should receive the same careful code review as application code because they control data access and validation. Reviews should first identify broad or global match rules that may unintentionally grant universal access, then assess how documents containing personally identifiable information are separated and restricted to the appropriate user. Effective rules testing through the Firebase Emulator Suite should cover every document type and permission, including successful requests and each expected denial case, with clear test descriptions and rule comments aiding review. Firestore reviewers must also verify that subcollections have explicit rules because they do not inherit parent permissions, unlike Realtime Database child nodes. Rules should enforce required, immutable, typed, and range-constrained fields on both creates and updates where applicable. Finally, security assessments must consider backend access through the Admin SDK and Cloud Functions, which bypass Security Rules and can introduce separate paths for exposing or modifying user data.