Account security
Behind the Scenes: How We Secure Your Login and Sessions
August 25, 2026 · 5 min read
Account security is one of those things nobody thinks about until something goes wrong, so here's a plain explanation of how social.fluxx handles login and keeps your session secure behind the scenes.
Login runs through Firebase Authentication
social.fluxx uses Firebase Authentication, Google's authentication infrastructure, to handle sign-in. Firebase manages password hashing, credential storage, and the security details of authentication itself, rather than social.fluxx handling raw passwords directly. This is standard, well-audited infrastructure used across a huge range of production applications, not a custom-built login system.
How sessions actually work after you log in
After you sign in, the app exchanges your Firebase login for a session cookie, an HttpOnly cookie that browser-side JavaScript can't read directly, which reduces the attack surface for common web vulnerabilities like cross-site scripting. Every request to a protected page or dashboard route checks that cookie server-side before granting access, rather than trusting anything set client-side.
Why this pattern, specifically
This is a widely used and well-documented production pattern for combining Firebase Auth with server-rendered apps, precisely because it avoids storing sensitive tokens somewhere a malicious script could read them. It's a deliberate, established choice rather than something built from scratch and hoped to be secure.
The takeaway
Login credentials are handled by Firebase's authentication infrastructure, not custom code, and sessions run through HttpOnly cookies that stay out of reach of client-side scripts. Both are deliberate choices, not defaults left unexamined.
Start free