旋转（删除）firebasestoragedownloadtokens是个好主意吗？
我的用例是，我想流式传输一个已上传到Firebase存储的视频。
我的理解是，当视频首次上传时，创建了firebasestoragedownloadtoken。
然后，无论何时，在客户端应用中，我都会调用getDownloadurl用户可以访问该秘密令牌，并且可以从技术上可以与其他人共享以观看或下载的其他网址。
我真的不需要长期生活的访问或视频可以共享。
不是更安全地以新价值刷新Firebasestoragedownloadtokens吗？
这将阻止被盗的URL工作。
然后，如果用户想再次观看相同的视频，则通过getDownloadurl获得包含新令牌的新URL。
您认为这是一种安全措施是有道理的吗？ 如果我在观看视频时更改了FirebasestorageDownLoadTokens，该怎么办？溪流会停止排放吗？
My use case is that I want to stream a video which was uploaded to firebase storage.
My understanding is that when the video is first uploaded a firebaseStorageDownloadToken is created.
Then whenever in the client app I call getDownloadUrl a user gets access to the secret token and can technically share the url with others to watch or download.
I don't really need the long lived access or the videos to be shareable.
Isn't it then more secure to periodically refresh firebaseStorageDownloadTokens with a new value?
That would prevent the stolen urls from working.
And then if a user wants to watch same video again a new url through getDownloadUrl is obtained containing a new token.
Do you think it makes sense as a security measure?
What would happen if a firebaseStorageDownloadTokens is changed while I'm watching the video? Would the stream stop emitting?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
虽然您肯定可以撤销默认令牌，但它不会自动与任何用户共享 - 因此，它被它们滥用的机会很小。但是：可以通过Firebase SDK上传以进行云存储的用户也可以在其上传的对象上调用
getDownloadurl，从而生成新的令牌。如果这对您的用例来说是一个重大问题，则可能不应通过Firebase SDK上传。（当前）在Firebase SDK中无法生成自动到期的URL。如果您愿意，请考虑使用云SDK之一进行云存储，该存储可以选择生成所谓的签名的URL 正是这样做的。
While you can definitely revoke the default token, it isn't automatically shared with any users - so the chances of it being abused by them are pretty small. But: users that can upload through the Firebase SDK for Cloud Storage can also call
getDownloadURLon the objects they upload and thus generate new tokens. If this is a significant concern for your use-case, you should probably not allow uploads through the Firebase SDK.There (currently) is no way in the Firebase SDK to generate a URL that automatically expires. If you want that, consider using one of the Cloud SDKs for Cloud Storage, which have the option to generate so-called signed URLs that do precisely that.