Chapter 26 · operating safely
No-auth verified-access form security
Protect the public application route with same-origin server validation, signed challenges, Firestore controls, and deny-all client rules.
1 min read·Updated 2026-07-26·3 role paths
01
No authentication does not mean direct database access
The form is public, but the browser never writes directly to Firestore. It posts to a same-origin Next.js server route. The server validates the request and uses Firebase Admin.
02
Validation gates
- JSON content type and request-size limit
- Strict Zod schema and unknown-field rejection
- Secret and credential-pattern rejection
- Honeypot field
- Same-origin and Fetch Metadata checks
- Signed HMAC challenge with expiration
- Minimum completion time
- One-time challenge use
- Firestore-backed duplicate and rate-limit controls
- Privacy-HMAC abuse identifiers instead of raw IP storage
- No-store responses
No Cloudflare or Turnstile account is required in the simplified release.
03
Firestore rules
The included rules deny direct client reads and writes to the application database. Server access is controlled through Firebase Admin and Google Cloud IAM.
04
Operational limits
These controls reduce abuse but cannot guarantee that every automated submission will be blocked. Monitor Firestore write volume, hosting logs, and unusual submission patterns.