Security

Firesearch was designed to be secure by default—this guide explains how it works, and what choices you have.

• Firesearch API security
• Firesearch web console security
• Make the service publicly available—to allow search in mobile or on the web ("Allow unauthenticated invocations" in Cloud Run) with Access keys.
• Use as a private service—ideal for backend only connections ("Require authentication" in Cloud Run)

Firesearch API security

All endpoints in the Firesearch API require the X-API-Key HTTP header containing the same FIRESEARCH_API_KEY string that is configured in the Google Cloud Secret Manager when you configured the secrets for Firesearch.

The exception to this requirement are the Search and Complete methods, which are also accessible using Access keys. This is how clients access the Firesearch API directly.

The Client libs and SDKs provide a way for you to set this value.

You should never make the FIRESEARCH_API_KEY key public. Learn more about Making the service publicly available.

Firesearch web console security

The Firesearch Console is protected with "Basic" authentication.

You set the credentials using the FIRESEARCH_BASICAUTH_USER and FIRESEARCH_BASICAUTH_PASSWORD secrets.

If you set FIRESEARCH_SECURITY=off then anybody with access to the instance (controlled via Google Cloud IAM) will be able to use the console.

When you are using the Firestore emulator on your local dev machine, you can use environment variables to set the secret values instead.

Make the service publicly available

Most users make Firesearch publicly available so that web browsers and mobile apps can perform searches directly.

Allow unauthenticated invocations

When you create your Cloud Run instance, you should set Allow unauthenticated invocations.

Although this opens the instance up to the public, Firesearch security still applies.

Use Firesearch access keys

You need to use Access keys to give clients permission to perform searches.

• Read the Access keys guide

The console is still protected

The Firesearch Console is protected by the "Basic" authentication credentials you set up when you configured the secrets for Firesearch.

Use as a private service

If the only connections to Firesearch are from trusted backend code, you do not need to make Firesearch publicly available.

If you deploy Firesearch with Authentication required in Cloud Run, you can turn off Firesearch security by setting the FIRESEARCH_SECURITY=off environment variable.

CAUTION: If you turn security off and the instance is available to the public, anybody can read from, write to, and even delete your indexes.

In this scenario you will manage connections to your instance using Google Cloud IAM.