I'm new-er in the stackoverflow community so if asking questions like this without code is frowned upon please just let me know in the comments how to ask Q&A like this.
It seems like there are always videos/courses on how to make web/mobile apps with Firebase but hardly ANYONE focuses on Firebase security beyond briefly touching on 'Firebase Security Rules'. I don't remember the last course I've taken that even brought it up.
Anyways. What is the best practice and secure way to put Firestore queries inside of our client-side code/components in React Native (Expo) or just in Javascript in general?
I see some people who just say to make sure my 'Firestore Security Rules' are in place to prevent anyone from just reading or writing data to my Firestore database. I've also heard that 'Firebase Cloud Functions' are the best place to put our queries because it's done on the server and therefore the code can't be messed with (that supposedly good hackers can change client code and make it do what they want? And if so, how do they do this?).
I really want to focus on security first with the projects I build and can't seem to find a good answer or simple explanation. I would appreciate anyone's knowledge on how to write secure queries with Firebase.
Thanks for any information or additional information in advance.
When writing queries to retrieve documents, keep in mind that security rules are not filters—queries are all or nothing. To save you time and resources, Cloud Firestore evaluates a query against its potential result set instead of the actual field values for all of your documents. If a query could potentially return documents that the client does not have permission to read, the entire request fails.
Here is some documentation that could help you to understand how the security works and how you can implemented it in your project.