Firestore security rules: update disabled but update perfectly

user_11312366 0
Viewed 93

My firebase project has connected with two flutter projects. I want to disable to update using

/Order/{uniqueCode} {
        allow read: if true;
        allow write: if true;
        allow update: if false;
        allow delete: if false;
    }

but both from my flutter app if I run this query

firestore!.collection('Order').doc(order!.orderId!).update({
                                            'payment': true,
                                            'paymentFrom': 1,
                                            'status': 2,
                                            'paymentDate': FieldValue.serverTimestamp()
                                          }).then((_) {
                                            print('update successfully');
                                          }).catchError((onError) {
                                            print(onError.toString());
                                          });

the fields is updated properly

firebase-security google-cloud-firestore flutter
1 Answers

If you try playing with the rules in the Rules Playground, it's the allow write: true that's allowing the update operation:

enter image description here

You can read more about granular operations. Create, update, and delete are all 'write' operations.

user_131306970
Related