[Feature Request] [storage] Download files with customer-supplied/managed encryption keys

[ksilz]

I asked about this on Stack Overflow but got no reply in four days. I created a companion request for FlutterFire.

My app stores files with Firebase Storage. I want to encrypt these files conveniently on the server. Firebase Storage uses Google Cloud Storage. And Google Cloud Storage offers two options for this: Customer-supplied encryption keys, where the app provides a key, and customer-managed encryption keys, where the app provides the name of the server-side “encryption service account” in Google cloud storage.

I think my Java back-end that creates my files would be fine: The Firebase Admin SDK uses the Java Cloud Storage library. And there Storage.BlobTargetOption has an encryptionKey() method for the customer-supplied encryption key, and a kmsKeyName() method for the customer-managed encryption keys.

But I don’t see how I can download files with customer-supplied/managed encryption keys in the Firebase Javascript SDK. I can't specify a key or key name when creating the reference to the file. And I can't specify these when getting the file's download URL, either.

So I suggest as a feature that Firebase Storage in the Firebase Javascript SDK supports both the customer-supplied & customer-managed encryption keys for Google Cloud Storage. As for the implementation of that feature, getting a download URL could be the place to specify either a customer-supplied encryption key or the name of a customer-managed encryption key.

[hsubox76]

In order to track this feature request, can you create a feature request issue? If you pick "bug report" from the options, the form should have some instructions (start the title of the issue with "FR:") and it will be tagged as a feature request. We don't have any formal means to track topics in Github Discussions so this could get lost over time.

[ksilz]

@hsubox76 Done.

[hsubox76]

Oh, heh, I think David might have had the discussions url saved in his clipboard because we are in the midst of the modularized Firebase alpha, and this is the center for non-bug feedback on that. Thanks for making the FR, I've tagged it as storage and we can track it there.

[ksilz]

Thank you!

[samtstern]

Is this mostly an SDK feature or a backend feature? Backend feature requests for FIrebase are best reported here:
https://firebase.google.com/support/troubleshooter/report

[ksilz]

It's an SDK feature request.

The backend already has it: Customer-supplied encryption keys, where the app provides a key, and customer-managed encryption keys, where the app provides the name of the server-side “encryption service account” in Google cloud storage

The Java SDK has it, too: Storage.BlobTargetOption has an encryptionKey() method for the customer-supplied encryption key, and a kmsKeyName() method for the customer-managed encryption keys.