title: Using Stripe Payments With Angular/Firestore
body: <p>I'm currently having a problem with how to securely implement payments with angular &amp; firstore.</p>
  <p>Currently</p>
  <ul>
  <li>Items are displayed to the user from a firestore collection.</li>
  <li>User buys item and is redirected to a stripe checkout.</li>
  <li>On the backend webhook listens for checkout.session.completed and saves the order to firestore collection on completion.</li>
  </ul>
  <p>My understanding is that with Firestore being accessible to anyone who has access to the webpage, a visitor could easily just write their own order to the collection &amp; even with restricting customers to being logged in as they are directly interacting with the orders collection they do need to be able to update it without maliciously updsting it.</p>
  <p>My question: can I mitigate this with security rules alone for example is it possible to pass a secret key with each order &amp; not allowing documents to be written if the key doesn't match. If not are their other options or will I have to restructure the whole app?</p>