Firebase custom claims as a list + security rules

user_6952891 0
Viewed 70

I am thinking of the following structure of security rules + custom claims:

auth.token.buckets = ['bucket1', 'bucket2', 'bucket3']

And the security rule like:

allow read if storage/{$bucket} is in auth.token.buckets

Is that possible? And if so, what would be the correct syntax?

firebase-security firebase-storage firebase-authentication firebase
1 Answers

That should be possible indeed.

  • The correct operator is in, since your token contains a list of keys.
  • The correct way to refer to the bucket is with bucket, without $ or {}.

So the total rules could be something like:

service firebase.storage {
  match /b/{bucket}/o {
    match /{path=**} {
      allow read: if bucket in auth.token.buckets;
    }
  }
}

Note that you'll have to store the full name of your bucket in the token, so something like your-project-name.appspot.com

user_2091030
Related