What would be the best Firestore rules when users should only be able to read and write their own collections, i.e. the collection name is the same as the userId? Currently I have the following which works, but is it secure enough?
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{userId}/{document=**} {
allow read, write: if request.auth.uid != null;
}
}
}
I also tried the following which didn't work.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{userId}/{document=**} {
allow read, write: if request.auth.uid == userId;
}
}
}
The first rule is indeed not sufficient, since there is no check on the collection name: any authenticated user can read all the collections named with any users' uid.
The second one should work for your requirements ("Users should only be able to read and write their own collections, i.e. the collection name is the same as the userId"). You are probably having an error somewhere else, e.g. with the code for writing or reading or for authenticating the user. You should share this code in order we double check it
Related
I played around with my Security Rules a little bit today and now I cannot create any more (chat)rooms when cliking the corresponding button in my app. I even put the security rules back to allowing all read and write requests, but still it does not work anymore. Any advice?
> rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
// every user can only read his own data
allow write: if request.auth != null && userId.matches(request.auth.uid);
allow read;
// add part to allow access if uid equals admiin uid
}
match /rooms/{roomId=**} {
allow write, read;
}
}
}
This is what I have in my rules setup but it does not allow me to view fetched data from firestore unless I'm logged in.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /Photos/{PhotoID}/{document=**} {
allow read, write: if request.auth.uid != null
}
}
}
The request.auth.uid != null will return false if a user requesting data is not logged in with Firebase Authentication. If you want anyone to to fetch data then the rule should be allow read: if true;.
I'm not sure about your use case here but it's best to allow users to read/write their own data only. For that you'll need to store their UID somewhere in the document.
Then rules in your questions apply for Photos collection and all of it's sub-collection as you are using a recursive wildcard.
You may visit there docs here
Basics of firebase security rules
In addition to #Dharmaraj answer:
The code you provided above helps you check if user is logged in, if logged in then it allows both read and write operation else disallows/denies the operation.
Then if you want a free access to your database such that it will not check whether logged in or not , remove the if condition and only end the command with semicolon[;],
But be careful because if you allow both read and write access without checking if user is authenticated or not, then you endanger your data to the entire world.
To allow only read access:
rules_version = '2';
service cloud.firestore {match /databases/{database}/documents
{
match/Photos/{PhotoID}/{document=**} {
allow read:if true;
allow write: if false;
}
}
}
To allow only write access:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match
/Photos/{PhotoID}/{document=**} {
allow read: if false;
allow write:if true;
}
}
}
I am collecting my admin users uid's as documents in "admins" collection. I want to allow users to read if they have their uid's in that collection as a document.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /admins/{document=**} {
allow write; // Everyone should be able to write
allow read: if request.auth.uid == ; // Only read if /admins/{youruid}
}
}
}
You can use exists() to check if a document exists. Try refactoring your rules as shown below:
match /admins/{document=**} {
allow read: if exists(/databases/$(database)/documents/admins/$(request.auth.uid));
// Only read if /admins/{youruid}
}
You can read more about exists() in the documentation.
Firebase keep telling me
We've detected the following issue(s) with your security rules:
any user can read your entire database
I have changed the rules but that rules doesn’t work in my app because all user can read from db and only authenticate user can write to db.
Firebase says that write and read should be performed until we login. But in my case every user can read and only login user can write.
Any ideas how to solve this ? or I'm I doing it wrong ?
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read;
allow write: if request.auth != null;
}
}
}
Can you set your read to false explicitly?
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read: if false;
allow write: if request.auth != null;
}
}
}
That should do it. Let me know if it persists.
The root cause is that even though you are allowing only authenticated users to read or write but they have access to the whole database as mentioned in the Google Cloud Firestore Documentation. That also means any authenticated user can write anything in your database.
If you database has a separate document for each user, I would suggest using the following rules which allows users to write/read their own data only.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth.uid === userId;
}
}
}
My database is built in a way that each User has his own document in users collection, that document's id is equal to the users id, and inside the document there is a collection of Tasks for each user.
when i use:
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.auth.uid != null;
}
}
}
Everything works and a logged in user (i only log-in users with google provider) is able to read and write to the database, in his own collection of tasks (haven't tried writing to another user's tasks, but i assume it is possible in the given situation). But i want to restrict the users to only be able to write and read their own tasks, i tried the following:
service cloud.firestore {
match /databases/{database}/documents {
match /users/{user} {
allow read, write: if request.auth.uid == resource.id;
}
}
}
But it does not work.
a scheme of my database:
database
any ideas?