Is Firebase Supposed To Run On The Client?

I'm interested in using Firebase (https://firebase.google.com/), I've looked at their docs and their JavaScript examples seem to run on the client, am I being really stupid or is t

Solution 1:

You can write security rules for your database, that validate the data that is saved and ensure that users can only read/write data that they're authorized for.

For example, you could ensure that users can only modify their own node under /users with:

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "auth.uid == $uid"
      }
    }
  }
}

I highly recommend reading the documentation on the security rules for the Firebase Database.

Solution 2:

To answer your question, your application code is all meant to be run on the client