Your Cloud Firestore database has insecure rules, how to fix it?

user_11925808 0
Viewed 4193

I use firebase rest API below to access my firestore database data

https://firestore.googleapis.com/v1/projects/testproject/databases/(default)/documents/Test/Employee?key=a29.ImCbB4CbV3CWoPouWsh24NrQ-3eKUmuK-dELilZGmPqqDlq4jJNWBmJ47MnJ1pBQSDPNqPeknqD4Usm9SIf6pmG-8sfK15QlkQR

to access my firestore database,I used my access token in the key portion but I receive email from firebase stated that "[Firebase] Your Cloud Firestore database has insecure rules". Only then I found out that anyone can access my database data even without a valid access token

So I tried to add some rule in the database as below and hoping that only a valid access token can access my database

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

but after added the rule, I can no longer query my database with REST API even with the valid access token, the rest api return below error

{
  "error": {
    "code": 403,
    "message": "Missing or insufficient permissions.",
    "status": "PERMISSION_DENIED"
  }
}

How should I edit the rule to make my database secure while still able access via REST API.

firebase-security google-cloud-firestore firebase
2 Answers

I think I figured out what's wrong with the access token, I have to pass the token as bearer in the header instead of passing it as the key in the url.

user_119258080

I found another way to accomplish what you asked without exposing the auth token. The solution I opted was to allow anonymous login in Firebase. Here you can see a more detailed explanation: https://stackoverflow.com/a/60426745/2636562

user_26365620
Related