I have created an app, that allows users to create a simple photo collection. All the data is stored in the Firebase Cloud Firestore. The images are uploaded to Firebase Storage.
The owner of a collection can invite any other user to access his collection and upload photos.
The sharing of data in Firestore works fine. But now I have problems with writing the security rules for Storage. Does anyone know, how I have to write the rules, so that any user added to the collection can access the images as well? The files for each collection are stored in separate folders.
Firebase security rules currently do not bridge between products. You can't use data in Cloud Firestore in security rules for Cloud Storage. The only things you have access to in security rules for Cloud Storage are object metadata and Firebase Authentication custom claims per user. You will have to figure out a way to make changes to either one of those things to implement your permissions.
Alternatively, you can direct all access through Cloud Functions to decide if the user should be able to access the content, but bear in mind that Cloud Functions responses can only be 10MB maximum.
You should look into creating a private group and authenticate the group with help of private token.
https://firebase.google.com/docs/storage/security/user-security#group_private
Related
I have migrated data to firebase storage, which have structure like:
<fileId>/<filename>
I can store fileIds associated with user in firebase database like:
<userId>/<fileids>
Is there anyway I can get something like auth.uid/fileids from firebase database in security rules of firestorage, to only allow to read file to auth user, if fileIds belong to him. If not, what all options are available to achieve the same and which one is best among them?
It's currently not possible to use data from databases in your Cloud Storage security rules. You can only use information about the object stored in the bucket.
You could instead write a backend API that performs all the checks and then operates on the object in storage, or store information about the file in its metadata for use in rules.
In Apple's iCloud, there's a Private bucket where the user can store data, using an iOS app created by a third party, that no one else, including the iOS app creator, can see.
Is there a similar mechanism in Google Cloud Platform?
First of all, I'm assuming that you intend to read and write this private storage directly from a client app.
If you're using Firebase Authentication to sign in the user on the client, you can use either Firebase Realtime Database or Firestore to store per-user private information. These products do not have an internal sense of dedicated storage for users. What you will have to do is assign that space on your own (perhaps a "users" node in RTDB, or a collection in Firestore), and protect that space with the security rules provided by that database product. The security rules will determine who can read and write what data, based on their Auth identity.
Since you tagged this Firestore, I'll assume you intend to use that. You should read up on security rules to better understand how this works. If you are not using Firebase Auth for end user authentication, this will not be possible, however.
I need to check a document's data in Firestore to allow someone to view an image in Firebase Storage. Is this possible?
It is currently not possible to access Cloud Firestore documents directly from Cloud Storage rules. You have two options:
Somehow use Firebase Authentication custom claims on the user account to determine if a user should be able to access a file.
Use some backend code (maybe a Cloud Functions HTTP trigger) that the user accesses to download the file if the conditions are met.
In either case, you will need some backend code that checks and sets the appropriate data.
I want to add firebase cloud storage security rules so that my file can be access by set of people's. List of people's are in my firebase database.
Can anyone help me please?
There is no way to access the Firebase Database from your Cloud Storage for Firebase security rules. You will have to set the information into the token for each user, and then access that in your storage rules.
Also see:
Restrict firebase database and storage write access to a specific group
is there a way to authenticate user role in firebase storage rules?
Create group access to firebase storage without using custom authorization
Some of these show embedding the UIDs in the security rules, which used to be the only way to do this. But nowadays you should probably user custom claims for this, as shown in Bojeil's answer to the first question above.
I understand that I can specify rules for some features in firebase like real-time database and firebase storage.
Example:
I can specify a rule in real time database that allows only users to update their data under their specific UID.
Question:
Is it possible to specify a rule in firebase storage such that a user can download a file (ex: image) if and only if he exists under a certain node in the real time database?
Is this communication between security rules of different products possible?
If no, what can I do?
Thanks.
You can't communicate between products like this.
What you can do instead is use custom claims on authenticated user profiles to control who can access what locations in various products.
Read more about custom claims here.
Read more about realtime database rules with custom claims. Read about auth.token.
In Firestore, you can use request.auth.token to access custom claims.
In Cloud Storage, you can also use request.auth.token.