Why authentication identifies users in Firebase - Why It Works This Way

Overview - Why authentication identifies users

What is it?

Authentication is the process that checks who you are when you use a service. It confirms your identity by asking for something you know, have, or are, like a password or fingerprint. This helps systems know exactly which user is trying to access them. Without authentication, services would not know who is using them.

Why it matters

Authentication exists to keep services safe and personal. Without it, anyone could pretend to be someone else, causing confusion, data loss, or security breaches. Imagine a bank that cannot tell who is withdrawing money; it would be chaos. Authentication protects users and services by making sure only the right people get access.

Where it fits

Before learning about authentication, you should understand basic user accounts and data privacy. After mastering authentication, you can explore authorization, which decides what an authenticated user is allowed to do. This topic fits early in the journey of securing cloud services and apps.

Mental Model

Core Idea

Authentication is the process that proves who you are to a system before it trusts you.

Think of it like...

Authentication is like showing your ID card at a club entrance to prove you are allowed inside.

┌───────────────┐
│ User tries to │
│ access system │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ System asks   │
│ for identity  │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ User provides │
│ credentials   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ System checks │
│ credentials   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Access granted│
│ if valid      │
└───────────────┘

Build-Up - 7 Steps

1

Foundation

What is Authentication

Concept: Understanding the basic idea of proving identity to a system.

Authentication means showing proof that you are who you say you are. This can be a password, a fingerprint, or a special code. When you log in to an app, it asks for this proof to know it is really you.

Result

You learn that authentication is about identity confirmation before access.

Understanding that authentication is about identity helps you see why systems ask for passwords or other proofs.

2

Foundation

Common Authentication Methods

Concept: Introducing different ways users prove their identity.

There are several ways to authenticate: something you know (password), something you have (phone or token), or something you are (fingerprint). Apps often use passwords because they are simple, but adding other methods makes it stronger.

Result

You recognize multiple ways to prove identity, not just passwords.

Knowing different methods helps you understand why some apps ask for extra steps like codes or fingerprints.

3

Intermediate

How Firebase Authentication Works

🤔Before reading on: do you think Firebase stores your password directly or uses another way? Commit to your answer.

Concept: Firebase uses secure methods to verify users without exposing passwords.

Firebase Authentication lets users sign in using email/password, phone, or social accounts. It does not store your password in plain text. Instead, it stores a secure version and checks your input against it. It also creates a unique user ID to identify you in the system.

Result

You understand Firebase protects your password and identifies you with a unique ID.

Knowing Firebase uses secure storage and unique IDs explains how it keeps users safe and distinct.

4

Intermediate

Why Unique User IDs Matter

🤔Before reading on: do you think users are identified by their email or by a special ID? Commit to your answer.

Concept: Firebase assigns a unique ID to each user to track them safely.

Instead of using your email or name to identify you, Firebase gives you a unique ID string. This ID stays the same even if you change your email. It helps the system know exactly who you are without confusion.

Result

You see that unique IDs prevent mix-ups and keep user data organized.

Understanding unique IDs helps you grasp how systems track users securely and reliably.

5

Intermediate

Authentication vs Authorization

🤔Before reading on: do you think authentication also decides what you can do, or is that separate? Commit to your answer.

Concept: Authentication proves identity; authorization decides permissions.

Authentication tells the system who you are. Authorization decides what you can do once identified. For example, logging in is authentication; editing a file is authorization. Both work together to keep systems safe.

Result

You learn the difference and connection between authentication and authorization.

Knowing this difference prevents confusion and helps design secure systems.

6

Advanced

Token-Based Authentication in Firebase

🤔Before reading on: do you think Firebase keeps you logged in by remembering your password every time? Commit to your answer.

Concept: Firebase uses tokens to keep users logged in securely without re-entering passwords.

After you log in, Firebase gives you a token — a special key that proves you are authenticated. This token is sent with each request to the server. Tokens expire after some time, so you must refresh them to stay logged in. This method is safer than sending passwords repeatedly.

Result

You understand how tokens keep sessions secure and convenient.

Knowing token use explains how apps balance security with user convenience.

7

Expert

Security Challenges and Best Practices

🤔Before reading on: do you think storing tokens on the client is always safe? Commit to your answer.

Concept: Understanding risks in authentication and how to protect against them.

Tokens stored on devices can be stolen if not protected well. Firebase recommends storing tokens securely and using HTTPS to encrypt data. Also, multi-factor authentication adds extra safety. Experts monitor for unusual login patterns to detect attacks early.

Result

You learn the hidden risks and how experts defend against them.

Understanding these challenges helps build stronger, safer authentication systems.

Under the Hood

When a user logs in, Firebase checks the credentials against a secure database where passwords are hashed (turned into unreadable codes). If valid, Firebase creates a JSON Web Token (JWT) that contains user identity info and expiration time. This token is signed to prevent tampering. The client sends this token with requests, and Firebase verifies it to confirm the user's identity without needing the password again.

Why designed this way?

This design protects user passwords by never sending or storing them in plain text. Using tokens reduces the risk of password exposure and improves performance by avoiding repeated password checks. The signed tokens ensure data integrity and trust between client and server. Alternatives like session IDs were less scalable and secure for modern cloud apps.

User Login
   │
   ▼
[Credentials Input]
   │
   ▼
[Firebase Server]
   │  Checks hashed password
   ▼
[Generate JWT Token]
   │
   ▼
[Send Token to Client]
   │
   ▼
[Client Stores Token]
   │
   ▼
[Client Sends Token with Requests]
   │
   ▼
[Firebase Verifies Token]
   │
   ▼
[Access Granted if Valid]

Myth Busters - 4 Common Misconceptions

Quick: Does authentication alone decide what a user can do? Commit to yes or no.

Common Belief: Authentication also controls what actions a user can perform.

Reality: Authentication only confirms who the user is; authorization controls permissions.

Why it matters: Confusing these can lead to security holes where users access things they shouldn't.

Quick: Do you think Firebase stores your password in plain text? Commit to yes or no.

Common Belief: Firebase keeps user passwords exactly as entered for easy checking.

Reality: Firebase stores only hashed versions of passwords, not the actual passwords.

Why it matters: Storing plain passwords risks user data if servers are hacked.

Quick: Is it safe to share your authentication token with others? Commit to yes or no.

Common Belief: Tokens are harmless and can be shared freely.

Reality: Tokens grant access and must be kept secret like passwords.

Why it matters: Leaking tokens allows attackers to impersonate users and access data.

Quick: Does changing your email change your Firebase user ID? Commit to yes or no.

Common Belief: User identity in Firebase depends on the email address.

Reality: Firebase user ID is unique and does not change when email changes.

Why it matters: Misunderstanding this can cause data loss or user confusion during updates.

Expert Zone

1

Firebase tokens include claims that can be customized to carry extra user info for fine-grained access control.

2

Token expiration and refresh mechanisms balance security and user experience but require careful implementation to avoid vulnerabilities.

3

Multi-factor authentication integration in Firebase adds layers of security but can complicate user flows if not designed thoughtfully.

When NOT to use

Authentication alone is not enough for full security; it should be combined with authorization and monitoring. For very high-security needs, consider hardware security modules or biometric-only authentication. Firebase Authentication may not fit offline-first apps without internet access.

Production Patterns

In real systems, Firebase Authentication is combined with Firestore security rules to enforce permissions. Developers use custom claims in tokens to manage roles. Monitoring login attempts and integrating multi-factor authentication are common practices to enhance security.

Connections

Authorization

Builds-on

Understanding authentication is essential before learning authorization, which controls user permissions after identity is confirmed.

Public Key Infrastructure (PKI)

Shares underlying principles

Both use cryptographic tokens and signatures to prove identity and trust without exposing secrets.

Human Identity Verification

Analogous process

Just like showing an ID card to prove who you are in real life, authentication proves digital identity to systems.

Common Pitfalls

#1 Storing user passwords in plain text in the database.

Wrong approach:

users = { 'alice': 'mypassword123' }

Correct approach:

users = { 'alice': hash('mypassword123') }

Root cause:

Misunderstanding that passwords must be protected by hashing to prevent theft.

#2 Sending user password with every request after login.

Wrong approach:

POST /api/data with body { password: 'mypassword123' } every time

Correct approach:

POST /api/data with header Authorization: Bearer

Root cause:

Not knowing that tokens replace passwords for ongoing authentication.

#3 Using email as the unique user identifier in the system.

Wrong approach:

userID = user.email

Correct approach:

userID = user.uid (Firebase unique ID)

Root cause:

Confusing mutable user data (email) with immutable unique identifiers.

Key Takeaways

Authentication proves who you are to a system before it trusts you.

Firebase Authentication uses secure methods like hashed passwords and tokens to protect user identity.

Unique user IDs keep user data organized and consistent even if personal info changes.

Authentication is different from authorization; one proves identity, the other controls access.

Tokens keep users logged in safely without sending passwords repeatedly, but must be protected carefully.