Firework damage currently ignores friendly fire, allowing you to kill others on servers even in peaceful zones. Even if you can't physically place blocks like lava.

To test it do:

/scoreboard teams add Temp

/scoreboard teams option Temp friendlyfire false

/scoreboard teams join Temp @a

/give @p minecraft:fireworks 1 0 {Fireworks:{Explosions:[{}]}}

Make sure other player has a block over them, and summon fireworks on them.

I have not tested it with the server property settings, though I imagine that would result in the same thing.