firestore rest api batchwrite permission denied

user_5135372 0
Viewed 430

I have disabled my security rules so anyone could update,write,create,read, delete allow read, write, delete, update, create;

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write, delete, update, create;
    }
  }
}

when i try to use `POST https://firestore.googleapis.com/v1/{database=projects/*/databases/*}/documents:batchWrite

with the body as below

{
  "writes": [
    {
      "update": {
        "name": "projects/project_id/databases/(default)/documents/service_order/352003090342435.5f357270173e8c70878.-9486573",
        "fields": {
          "managed_by": {
            "booleanValue": "false"
          },
          "location2": {
            "booleanValue": "false"
          },
          "made_by": {
            "stringValue": "352003090342435.5eda4f3c17284c58460.90921842"
          },
          "phone2": {
            "stringValue": "0665439307"
          },
          "state": {
            "stringValue": "confirm"
          },
          "write_date": {
            "stringValue": "1597664391000"
          },
          "made_by_name": {
            "stringValue": "FaridBenabdallah"
          },
          "description": {
            "stringValue": "e1"
          },
          "accepted_offer": {
            "booleanValue": "false"
          },
          "id": {
            "stringValue": "352003090342435.5f357270173e8c70878.-9486573"
          },
          "location1": {
            "stringValue": "352003090342435.5f3572a0173e8c7c336.-8281409"
          },
          "date_order": {
            "booleanValue": "false"
          },
          "order_type": {
            "stringValue": "Minuiserie"
          },
          "phone1": {
            "stringValue": "0657331995"
          }
        }
      },
      "updateMask": {
        "fieldPaths": [
          "managed_by",
          "location2",
          "made_by",
          "phone2",
          "state",
          "write_date",
          "made_by_name",
          "description",
          "accepted_offer",
          "id",
          "location1",
          "date_order",
          "order_type",
          "phone1"
        ]
      }
    }
  ]
}

` rest api it always responding with permission denied

{
  "error": {
    "code": 403,
    "message": "Missing or insufficient permissions.",
    "status": "PERMISSION_DENIED"
  }
}

however when i try it with Google OAuth 2.0 it's working

so there is something wrong with batchWrite when i use it without authoirzation header

firebase-security google-cloud-firestore firebase
1 Answers

It appears that there is something wrong inside the firebase as the support responded with

After performing some additional tests myself, it looks like this behavior might be isolated to the REST API, as none of our SDKs seem to be affected. I'll go ahead and raise this behavior with our engineers to see if this is intended behavior or if there might just be something missing in the original REST call. I'll make sure to get back to you as soon as I have any updates to share.

so i did a little research to find that i can use the commit rest api, as it looks the same but works without authoirzation header or with the firebase token as an authorization header

user_51353720
Related