Security for collaborators email invitations

I am trying to build a web application with Firebase through a shared to-do list. User groups have a common list, but for someone there is access to a specific list, they must either run the group or were invited to it. Invitations will be sent by e-mail, including to users who have not previously used the site. My goal is to avoid server-side code, and I'm using AngularJS. Each group list will have its own URL.

Login to the site will be with Facebook or username and email. I assume that it is possible to invite other Facebook users through Facebook, but I would prefer to avoid using the Facebook application and for simplicity I would like to adhere to the general invitation system for users, however they are logged in. Therefore, I intend to use the system to work as follows:

An existing group member will enter the email address of the proposed new member. JavaScript generates a random alphanumeric token, and the token is used to create a new child object of the Firebase location invitation, for example this

"invites": {
    "12345ABC": "Group Name"
},

with these safety rules

"invites": {
    ".read": false,
    ".write": false,
    "$token": {
        ".read": true
    }
}

This way you can only read the token if you know it there.

URL- , , Firebase. Zapier ( ) URL- . Email_queue Zapier cron- . (EDIT: Zapier , , , , ).

, , , , Facebook, .

, ?

: , - , , ? (Zapier, , ).

+4
1

, , . , - .

:

. , , , . , , , . security.contains, , .

, . . , , .

+1

Source: https://habr.com/ru/post/1545220/


All Articles