Security Rules Basics

Security Rules Basics

Getting your code working isn't the whole job on a Firebase project. You still need rules to control who can read and write your database and Storage. Get the rules wrong, and your app can look polished on the surface while the backend door is left wide open.

Firestore Owner-based Rule Example

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /notes/{noteId} {
      allow read, update, delete: if request.auth != null
        && resource.data.ownerId == request.auth.uid;

      allow create: if request.auth != null
        && request.resource.data.ownerId == request.auth.uid;
    }
  }
}

What does this rule do?

It checks that only a logged-in user can create/read/update/delete a note. For read/update/delete, it checks the ownerId of the existing document, and for create, it checks the ownerId of the data being written.

Common mistake

Leaving allow read, write: if true; turned on during the learning phase and forgetting to close it later is extremely risky. Switch to owner-based rules as soon as you're done testing.