Anyone can exhaust your Auth quota and take the project down
Rejected requests to identitytoolkit (401 invalid App Check, 400 per-IP) and securetoken (refresh) still count against the project quotas (1,000 QPS, 10M/day, 18,000/min) — confirmed by measurement and Firebase Support (case #10417533). A single IP with no valid credentials can consume shared quota. Developers have no WAF or per-IP rate limiting for these client-facing endpoints, and no supported mitigation, so an external party can force an Auth availability outage on any project using client-side Auth.
AWS Cognito solves this: attach a WAF web ACL to a user pool, and blocked requests don't count toward quota. Please add equivalent edge filtering for Firebase Auth.
4
votes
Qenado
shared this idea