Intermediate topics in Firebase Security Rules - Firecasts
Why Stack Overflow recommends it
Stack Overflow users link it when answering Firestore security rules questions about limiting writes to specific fields, admin lists and role-based access, since it shows working rule patterns.
Recommended by 6 people across 5 different months, 2020 to 2024.
What it is
A 30-minute Firecasts episode from the Firebase team, presented by Todd Kerpelman and Rachel Myers, covering intermediate Firestore Security Rules topics. It walks through custom auth claims, user-list based access, custom functions, request.resource, field-level restrictions, debugging rules and the mapDiff object.
What people said
Recommends Frank van Puffelen · 2020-08 · Stack Overflow · on “Security of Firestore Database - SwiftUI”
As I explained on your previous question [LINK] , anyone can take the configuration data from your app, and call the Firebase APIs with that data. is this secure? Only you can determine whether your rules are correct for your use-case. These rules allow anyone to read all documents in the /Users collection. In addition they allow any authenticated user to read and write all documents. If that is the use-case you want to support, the these are the correct rules for you. So if you've enabled the anonymous authentication provider in Firebase Authentication, anyone can take you configuration data, write a minimal web page and call firebase.auth().signInAnonymously() and then read all user data w
Recommends cSn · 2020-08 · Stack Overflow · on “Firebase security rules to an specific field”
Firebase team come up with a very interesting explanatory video where they talk about this case: [this video] After document creation you can setup restrictions on which fields can actually be altered.
Recommends Frank van Puffelen · 2020-08 · Stack Overflow · on “Firestore per-field security rule”
For write operations this should be possible. Did you try anything yet? I recommend studying this (very recent) video too: [this video]
Recommends Todd Kerpelman · 2020-09 · Stack Overflow · on “Deny the deletion of one property on a resource”
We cover this in a lot of detail starting at the 21:53 mark of this video [this video] , and I would definitely recommend watching the entire thing if you want a better understanding of how security rules work. But to answer your question, you could do this by saying... allow update if: ( (request.resource.data.lockedProperty == resource.data.lockedProperty || hasPermissionToChangeLockedProperty()) ) Essentially, you're saying "the value of locked property has to be the same in the document before it was changed and in the document afterwards". Although if you're going to do this with multiple fields a more general purpose way of doing it would be to say: allow update if: ( (!(request.resource.da
Recommends letmeask · 2021-02 · Stack Overflow · on “cloud firestore role based access example: can user create a comment?”
Surely I will click the upvote when I have enough reputation point. Already clicked the checkmark. Also found that this request.resource.data.authorId is well explained at [this video] dated Aug 4, 2020, very recent. But to be honest, I still feel a little weird that some uid (myId) can have the possibility to supply a different id (theirId) for something myId created. To me, this seems a bug waiting to be exploited. Anyway, I know very little and happy to use whatever it is :)
Recommends ObjectJosh · 2021-09 · Stack Overflow · on “security rules to allow update of specific fields”
If you prefer the method of specifying which fields can be editable , I found a section in this tutorial to be helpful: Intermediate topics in Firebase Security Rules - Firecasts [this video] // Make sure the request has only the specified allowed fields function editingOnlyAllowedFields(allowedFields) { let editedKeys = request.resource.data.diff(resource.data).affectedKeys(); return editedKeys.hasOnly(allowedFields); } // Then, you can specify which fields you want to be updatable allow update: editingOnlyAllowedFields(["field1", "field2"]);
Recommends egeer · 2024-01 · Stack Overflow · on “Firebase securityrules. How to allow access for admins stored in an array inside document?”
I believe the answer is yes to all three questions: You can use the || operator Yes, functions are allowed! Yes, rules are inheritted top down I very much so recommend these two videos: Security Rules! | Get to know Cloud Firestore #6 [LINK] Intermediate topics in Firebase Security Rules - Firecasts [this video] rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { function isAdmin() { let admins = get(/databases/$(database)/documents/roles/admins); return request.auth.uid in admins.data.users; } function isOwner() { return request.auth != null && request.auth.uid == userId; } match /{document=**} { allow read, write: if isAdmin(); } match /users/{userId} { allow