Insecure rules in firebase

user_16775600 0
Viewed 51

I understand it's not good to set your read and writes to all users on Firebase; But what if you leave your reads to all and your writes to only authenticated users?

What is the worst thing that could happen? Is it easy for someone to gain access to the firebase project? I'm currently using cloud firestore.

Sorry if this seems a little dumb, I'm new to this:

Thanks, Jacob

EDIT: Current Rules:

  service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
     allow read: if true;
      allow write: if request.auth != null;
    }
  }
}
firebase-security google-cloud-firestore
1 Answers

I've worked with Firebase for a long time and I've come to realize that the rules are a very good way to prevent unauthorized access to your data, by any third party - especially when used in tandem with rules set within your Application (be it Web, iOS or Android).

Personally, I usually set my rules to the following:

service cloud.firestore {
match /databases/{database}/documents { match /{document=**} { 
    allow read, write: if request.auth != null; 
}

This means that only logged in users are allowed to access the data and write data as well.

If, instead, you want users to access the data without being logged in but only write data if they're logged in, then I would suggest these rules:

service cloud.firestore {
match /databases/{database}/documents { match /{document=**} { 
    allow read;
    allow write: if request.auth != null;
}

In terms of how easy it is to access a Firestore Database when not authorized to: Google has done a good job at keeping things secure.

Setting up these rules and some other checks within your Application is enough to keep things secure.

user_166268480
Related