title: How secure is firebase with auth?
body: <p>I am not sure where to begin but I recently saw 'Firebase' while searching for no server database, while it seems interesting to me, I was little worried about putting my api codes directly in the js files, which obviously can be seen through source but I have read that you can change the read/write rules and need authentication. so I no longer worried about API after reading through some pages </p>
  
  <p>but the main question is:</p>
  
  <p>I wanted to create an admin portal for my page, so example my admin page is located in <strong>localhost/admin/</strong> &lt;&lt;&lt; The page will simply have a login form which is to access the portal, so everything is set</p>
  
  <pre><code>var config = {
      apiKey: "",
      authDomain: "",
      databaseURL: "",
      projectId: "",
      storageBucket: "",
      messagingSenderId: ""
  };
  
  firebase.initializeApp(config);
  
  firebase.auth().onAuthStateChanged(function(user) {
  
        if (user) {
        window.location = '/portal.html'
        }
  
        else {
        // Do nothing
        }
  });
  
  $("#loginbtn").click(function() {
  
  var email = $('#login-name').val();
  var password = $('#login-pass').val();
  
  firebase.auth().signInWithEmailAndPassword(email, password)
      .catch(function(error) {
    // Handle Errors here.
  
  });
  
  });
  </code></pre>
  
  <p>So when I log in successfully it will redirect me to that page but can someone just look through source code and then go that page manually and enter it?</p>
  
  <p>Or even if I intend to build one page application and decide to change the page state after login, whatever functions i'm going to do after that, can someone still find out and inject the code ?</p>
  
  <p>I'm not really expert on this but this what I was thinking before starting my project, so is there is any other way around?</p>