I'm developing a simple app where users can upload pictures. The app directly uploads images to Firebase Storage from the client, and sends the URL of the uploaded image to my server. I'm concerned about the security of this. There's no way to rate-limit users uploading images, so one malicious user could hypothetically upload millions of images and burn through my budget.

What's the standard way of handling this? I'm also considering proxying uploads through my server which gives me more control but is less performant and wouldn't really stop a dedicated user.