allow read, write: if request.auth != null;

user_14307385 0
Viewed 761

I have this warning:

Your Cloud Firestore database will start denying client requests unless you update your security rules

and it says I have one day to change them.

I don't know much about it, I've tried watching some videos but I'm in over my head. Saw that I could just change the date but would prefer to have proper rules. All I can do with my app so far is register/sign-in/sign-out(no email verification yet).

So with that, are my security rules safe for now?

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    allow read, write: if request.auth != null;
    }
  }
google-cloud-firestore dart flutter
1 Answers

"Safe" is not an absolute term. Your rules require that the user signed in to Firebase Authentication before they can read/write the entire database. If that is the minimum security requirement for your app, it is "safe" according to your requirements and you can turn off the notification.

For most apps, this is not considered safe though, as anyone can take the configuration data from your app, and start making API calls on their own. They can easily delete your entire database (bad for you), or read all data (even worse for your users).

The security rules of your database should follow the principle of least privilege and should only allow what your code does, and nothing more.

So the step by step process is:

  1. Remove all access permissions from your database (if false).
  2. Run the app and see where it fails.
  3. Change the security rules to allow only that code to succeed, but nothing else.
  4. Go back to step 2.

This way your security rules closely follow your application code, and is how I typically develop them myself too - the only difference being that I do this from the start of the project, rather than after building all the code.

Also see these previous questions about the error message.

user_2091030
Related