Firebase: Should I add GoogleService-Info.plist to

问题:

I'm using Firebase for an iOS project that I want to open source. Should I add GoogleService-Info.plist to .gitignore before I upload I share the project on Github?

I know it contains my API key, client id, etc., which might not be safe to expose?

回答1:

While it's not the end of the world if you commit GoogleService-Info.plist (similarly, on Android, google-services.json), you're better off leaving it out for one big reason: You're making it clear that others who build your code that they should be setting up their own Firebase project to host its configuration and data (because your project simply won't build with that file missing). Furthermore, if your project has world-writable resources in it, you can expect that people who get a hold of your app and config so easily will inadvertently start writing data into it, which is probably not what you want.

Open source projects that require a Firebase setup should ideally have it stated in the readme that anyone who wants to work with this app needs to go through the process of setting up Firebase.

The data in these config files is not exactly private - they can be extracted fairly easily from an IPA or Android APK. It's just probably not in your best interest to share them as part of your app's code.