Firebase rules change - firebase

I want to stop reading data from firebase by using rules change. Here is the rules:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write;
}
}
}
I want to disallow all. How to do that ?


Change this:
allow read, write;
to this:
allow read, write: if false;

Related

Set firebase storage to write only

I need to set firebase storage rules so unauthenticated users can upload a file but can't read a file.
So far I have:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow write: if true
allow read: if false
}
}
}
Is this the correct way to do this?

This rule will help you to read only if user is authenticated else it won't allow. For more details you can read docs
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read: if request.auth != null;
allow write: if true;
}
}
}

How to create rule that allow update only that value that is bigger than 0 in Firestore?

I would like to create a rule for my database in the firestore that does not allow updating items to a value less than 0.
Data structure collection - users - document id (random) - value name online. users/docID/{online: 0, etc..}
I try something like this but it doesn't work. How to do this right?
Dart code that is responsible for update
Firestore.instance.collection('users').document(docID).updateData({
'online' : FieldValue.increment(-10.0)
});
Security code
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write;
}
match /users/{user} {
allow update: if request.resource.data.online > 0
}
}
}

As explained in the doc, "In the case where multiple allow expressions match a request, the access is allowed if any of the conditions is true."
In your case, match /{document=**} and match /users/{user} actually overlap therefore any update is authorized, because the rule for match /{document=**} is allow read, write;
The following should do the trick:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{user} {
allow read: ....;
allow create: ....;
allow delete: ....;
allow update: if request.resource.data.online > 0;
}
}
}

Flutter - [Firebase] Your Cloud Firestore database has insecure rules

I Don't know why I am getting this mail, I never used Firebase Database in my flutter project,
After clicking on the hyperlink it redirects to this code
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}

If you do not intend to to use Cloud Firestore Database at all in your project, I'd suggest turning off all read/writes. That will also stop the email-reminders of the insecure rules.
Simply change the allow read, write: if true; to allow read, write: if false;
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
}
}

Firestore security rules and vuefire

i have the following sample app here: Github repo
It uses vuefire in ChatList.vue
// vuefire firestore component manages the real-time stream to that reactive data property.
firestore() {
return {
chats: db.collection('chats').where('members', 'array-contains', this.uid)
}
},
I now wrote security rules to secure the data, but can't seem to get the combination of vuefire and security rules to work:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
// THIS IS THE PART I'D LIKE TO REMOVE
match /chats/{chatId=**} {
allow read: if request.auth.uid != null;
}
// THIS WORKS AS INTENDED, AND I'D LIKE TO INCLUDE "READ"
match /chats/{chatId}/{documents=**} {
allow write: if chatRoomPermission(chatId)
}
function chatRoomPermission(chatId) {
return request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.members;
}
}
}
So the goal is: make the individual chats only readable and writable to users that are in the members array in firestore. (Currently i achieved this partially, since all chats are readable to anyone, but only writable to users in the members array.)
Do i have to rewrite the vuefire component so i can have the following security rule? (It gives an error message: listing of chats not possible due to missing permissions)
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
match /chats/{chatId}/{documents=**} {
allow read, write: if chatRoomPermission(chatId)
}
function chatRoomPermission(chatId) {
return request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.members;
}
}
}
For completeness, the working solution is (credits to Renaud Tarnec):
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
match /chats/{chatId=**} {
allow read: if request.auth.uid in resource.data.members;
}
match /chats/{chatId}/{documents=**} {
allow read, write: if chatRoomPermission(chatId)
}
function chatRoomPermission(chatId) {
return request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.members;
}
}
}

Since you want to check, in your Security Rules, if a given value (the user uid in this case) is contained in a field of type Array in your document, you can use the in operator of the List type.
So, the following should do the trick:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
// THIS IS THE PART I'D LIKE TO REMOVE
match /chats/{chatId=**} {
allow read: if request.auth.uid in resource.data.members;
}
// ....
}
}

flutter app is unable to ineract with firebase cloud database

i have set my firebase cloud database rule to default
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
}
}
but while my flutter app tries to interact with it, this error occurs
Error performing get, PERMISSION_DENIED: Missing or insufficient permissions., null

This condition:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if false;
}
}
}
means you are disallowing both read and write from and to firestore, you can change the rules to the following:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read : if true;
allow write: if false;
}
}
}
Which will allow you to read but not write to the database, or you can use the following:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.time < timestamp.date(2020, 9, 20);
}
}
}
Use the above rules just for testing, check here:
https://firebase.google.com/docs/firestore/security/rules-structure

Resources