Firebase FCM publisher/subscriber on javascript client

Question

We are trying to implement a publisher/subscriber model on our Frontend with Firebase.

Our goal: Deliver a message from JS-client publisher to JS-client consumer as fast as possible – ideally using WebSockets.

The Firebase documentation concentrates rather on Android/iOS devices, but it doesn't well clarify the difference between server-side and client-side JS solutions.

What I understood is that we primarily need to associate the device with a topic on the server, however, then I am not clear whether we can publish/consume the topic without server interaction.

https://github.com/firebase/quickstart-js/blob/8a5887858ea672efbeebabd85c057415809b9a8c/messaging/index.html

This example demonstrates subscription to a topic and handling the incoming messages – but – is it also possible to directly publish to the topic?

After you have created a topic, either by subscribing client app instances to the topic on the client-side or via the server API, you can send messages to the topic. If this is your first time building send requests for FCM, see the guide to your server environment and FCM for important background and setup information.

(Taken from https://firebase.google.com/docs/cloud-messaging/ios/topic-messaging) Here they mention the fact, that one can subscribe to a topic directly from a client? How so? From the doc and example above this seems not possible?

There is a NodeJS example of publishing to a topic:

var topic = 'highScores';

var message = {
  data: {
    score: '850',
    time: '2:45'
  },
  topic: topic
};

// Send a message to devices subscribed to the provided topic.
admin.messaging().send(message)
  .then((response) => {
    // Response is a message ID string.
    console.log('Successfully sent message:', response);
  })
  .catch((error) => {
    console.log('Error sending message:', error);
  });

Is it feasible to send this client-side?

Answer 1

FCM is designed with the expectation that messages are delivered from the backend and received on the frontend. Anything else is not recommended.

You are certainly free to try to send messages from your frontend using the REST API, but you will open up security issues because you would have to make your service account details available to client apps. If you expose your security account credentials like this, anyone can take that and send messages to your app at will (and possibly more, depending on what privileges are granted to that account). Just don't do that - keep your service account credentials on a secure backend only.

The examples in the FCM documentation all show use of backend SDKs (primarily the Firebase Admin SDK) to send messages. Stick to that.