Firestore Security Rules - How to Hack a Firebase App
Why Stack Overflow recommends it
Stack Overflow users link it when someone asks how to stop clients from reading or writing Firestore data they shouldn't, or needs a worked example of role-based security rules.
Recommended by 2 people across 2 different months, 2018 to 2021.
What it is
A 10-minute Fireship video that shows how a Firebase app can be attacked from the browser, then walks through writing Firestore security rules to protect data. It covers rule syntax, authentication checks and role-based access, with an accompanying written lesson and a link to the rules reference.
What people said
Recommends la39zz · 2021-07 · Stack Overflow · on “How to isolate firebase variable from browser console”
The attackers can access the firebase variable from the console, but you can set up security rules to keep your database safe. There is a video on this topic that Fireship made on youtube => click here [this video]
Recommends samthecodingman · 2021-10 · Stack Overflow · on “How to make some part of the data in Firestore inaccessible to my frontend?”
If written documentation isn't your thing, the Firebase YouTube [LINK] and some community channels like Fireship [this video] cover the topic quite well.
Cites pdm LVW · 2018-11 · Stack Overflow · on “Firestore role based security roles not working properly”
Hello I need to configure firestore security roles for my ionic app as shown in here [this video] . But when it applies to my firestore it always say permission denied. If i use just WRITE:TRUE its working. Here is my firestore db [LINK] and Here how i defined security roles according to myone match /tournaments/{tournamentsID} { allow read:if isLoggedIn(); allow write:if getUserData().roles.keys().hasAny(['subscriber']); } function getUserData(){ return get(/databases/$(database)/documents/users/$(request.auth.uid)).data } Now I edited it as allow write:if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.roles.subscriber == true Then its working. But if i try same thing using
Cites Loopaka · 2020-10 · Stack Overflow · on “Limiting the write access to Firestore DB outside app UI”
I'm trying to build an app that works like a classic videogame, with some challenges that the user must complete in order to advance. Based on how the user solves the puzzles, he/she will gain XP points, badges etc. The user can quit the app and come back later, with an authentication system. I'm planning to use Firebase Auth for authentication and Firestore for the database. It's the first time I use Firebase services in (somewhat) production environments, but I've been experimenting a lot with their services lately. Firestore will be used to store a set of data for every user, but mainly his/her score. I'm somehow familiar with Security Rules in Firestore, and know how to make sure that on