Security Rules! 🔑 | Get to know Cloud Firestore #6

What people said

Strong rec Renaud Tarnec · 2020-08 · Stack Overflow · on “Firebase data validation based on timestamps”

If you use a date format like YYYYMMDD (which allows to lexicographic order [LINK] dates), the following should do the trick. It would also work with timestamps in milliseconds. match /organisations/{orgID}/people/{userID} allow create: if request.resource.data.dateEnd > request.resource.data.dateStart; } As explained in the doc [LINK] , "When writing data ... the request.resource variable contains the future state of the document". I would suggest you watch the official video about security rules [this video] , a must watch... If you absolutely need to store the values as DD/MM/YYYY in the Firestore document you should have two pairs of fields: a dateEnd / dateStart pair of field with format DD/

Strong rec Ramon Orraca · 2022-07 · Stack Overflow · on “Firebase database schema”

The following answer goes for anyone using Firestore and having this same question. Firebase security rules, this video [this video] does an amazing job explaining them, are a way in which you can sort of create schemas. An important consideration when using these rules is that if you're using the Firestore Admin SDK [LINK] (used for backend code) then your rules will be bypassed. To enforce this rules the request must come from a client SDK [LINK] . I think that one of the best things about Firebase is serverless computing [LINK] so this type of validations should work just fine with most requests considering they come from the client. To validate requests coming from a source that bypasses the

Strong rec Joshua Dance · 2022-10 · Stack Overflow · on “firestore: PERMISSION_DENIED: Missing or insufficient permissions”

There are lots of good answers, but as this is the top Google response for Firestore permission denied errors, I thought I would add an answer for beginners and rookies. Why Security Rules? If you wrote your own backend, you would have users ask your server for something, and the server would decide what they are allowed to do. For example your server wouldn't allow user1 to delete all of user2's data. But since your users are interacting with Firebase directly, you can't really trust anything your users are sending you. User1 could just change the user id on his delete request to 'user2' for example. Firestore Security Rules are where you tell Firestore aka your backend server, who is allow

Strong rec egeer · 2024-01 · Stack Overflow · on “Firebase securityrules. How to allow access for admins stored in an array inside document?”

I believe the answer is yes to all three questions: You can use the || operator Yes, functions are allowed! Yes, rules are inheritted top down I very much so recommend these two videos: Security Rules! | Get to know Cloud Firestore #6 [this video] Intermediate topics in Firebase Security Rules - Firecasts [LINK] rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { function isAdmin() { let admins = get(/databases/$(database)/documents/roles/admins); return request.auth.uid in admins.data.users; } function isOwner() { return request.auth != null && request.auth.uid == userId; } match /{document=**} { allow read, write: if isAdmin(); } match /users/{userId} { allow

Recommends Frank van Puffelen · 2019-01 · Stack Overflow · on “Creating Schema in Firebase database with NodeJS”

Can we create schema in firebase db as we are used to creating in mongoose? Firebase comes with two databases: the Realtime Database, and Cloud Firestore. Both of those are schemaless NoSQL databases. But in both cases, you can use the database's server-side security rules to control what type of data can be written to it. For Realtime Database, see the documentation [LINK] , and this classic video [LINK] for an introduction. You'll specifically want to look at the .validate rules here. For Cloud Firestore, see the documentation [LINK] , and episode 6 in the Getting to know Cloud Firestore video series [this video] .

Recommends JeremyW · 2019-03 · Stack Overflow · on “Can I implement chat functionality via Firebase Cloud Functions?”

@ConstantinBeer I remember this video [this video] from the official Firebase team being really helpful when I was learning about Firestore security rules. In fact, I remember their whole Firestore video series [LINK] being pretty good. Might be worth your time.

Recommends Zhangir Siranov · 2019-08 · Stack Overflow · on “Which is the best way to perform CRUD operations on firestore using flutter?”

I think it depends on the documents that you are working with. As long as you specified the security rules for specific document paths and all the data is validated within the app and in the security rules, you should be fine to complete these operations from the app. It is also important to give access to only authenticated users, you can implement firebase_auth plugin for that. You can check-out this video to understand the security rules [this video] If you are performing anything else than CRUD, like managing notifications or dynamically changing the documents in the background - that's where you can get the most out of Cloud Functions. Firebase team also has great videos about it.

Recommends osaxma · 2020-01 · Stack Overflow · on “Can two Apps (owner and client) share same database with different authentication spaces?”

One way to do it is to create private documents (either using cloud functions or from some server) describing the roles of each user based on their authentication ID. Then you can use Firebase Security Rules to determine which data can be accessed by whom, and whether they can edit them or not. This video [this video] from firebase channel does explain a similar scenario and it's generally about the security rules of Firestore.

Recommends 89f3a1c · 2020-07 · Stack Overflow · on “How to write a document firestore”

You have to correctly set firestore rules. I recommend you watch this official video [1] where they explain everything you need to know. That video is part of the "Get to Know Cloud Firestore" playlist [2]. I really recommend you watch the whole playlist. Doesn't take too long, and it really pays off. [1] [this video] [2] [LINK]

Recommends Rafael Lemos · 2020-11 · Stack Overflow · on “Firebase Security Rules restrict access to sub collections”

You are using a {users} to refer to your collection name, that is incorrect, you need to simply use it without the brackets since those are used as wildcards in your rules, eg. you can use /users/{userId} to match the userId in the rules. Also I would not recommend using a rule for all collections at the beggining of your rules, as it's a bit error prone. That being said, the following rules should work in your case: service cloud.firestore { match /databases/{database}/documents { match /users/{userId} { allow read; allow write: if request.auth != null; } match /users/{userId}/wishlists/{restOfPath=**} { allow read,write: if request.auth != null; } } } Try it out and let me know if it's sti