Don’t trust your Flutter app: verifying RevenueCat entitlements with the Firebase Extension
Blog post from RevenueCat
The text provides a comprehensive guide on securing premium content in mobile apps, using a hypothetical app called "Catflix" as a case study. It discusses the vulnerabilities of client-side checks for premium content access and suggests more secure alternatives, such as implementing Firebase App Check and server-verified entitlements through Firebase Cloud Functions and RevenueCat. The text explores different approaches, including direct API calls, custom webhooks, and the RevenueCat Firebase Extension, which automates the syncing of user entitlement data to a Firestore database. It emphasizes the importance of not relying on client-side checks due to their susceptibility to tampering and highlights the benefits of using server-side solutions to ensure only authorized users access premium content. Additionally, it touches on the use of custom claims in Firebase Auth to efficiently manage user entitlements and the importance of refreshing ID tokens to reflect updated user statuses promptly. The article concludes by stressing the necessity of securing Firebase projects, protecting sensitive API keys, and staying updated with evolving technologies, such as the experimental Dart SDK for Firebase Cloud Functions.