Questions tagged [firebase-security]
The Firebase Security API uses a flexible authentication system and an expression-based rules language to provide a very flexible security model.
4,841
questions
0
votes
0
answers
9
views
Firestore rules - wildcard not getting data?
Hi I'm looking for help regarding some Firestore rules.
For some reason wildcards don't seem to work, or I'm doing something wrong...
Basically I'm trying to only allow 'read' permissions on a ...
0
votes
1
answer
16
views
Firebase firestore permission denied on Local host but work well online
I am working on a web app and I faced to new problem on localhost which is FirebaseError: Missing or insufficient permissions but the live version of app that use same firebase firestore works ...
0
votes
0
answers
8
views
Firebase realtime database configure rules
Is there a way to set the value of a key to null therefore delete it, if its new value is 0. For instance:
"totalGames": {
"ps5": 15,
"ps4": 10,
"ps3&...
0
votes
0
answers
20
views
Disable all write requests momentarily for DB migration in Firestore security rules
I have a project that I need to restructure its Firestore DB. Currently, it's in daily use, so I need to disable all write (& maybe read) access for users only (not admin) until I can fully ...
0
votes
0
answers
31
views
Missing or insufficient permissions. request.auth seems to be null
I implemented the following security rules:
match /client/{clientId} {
allow read: if request.auth != null;
allow update, delete,create : if request.auth != null && request.auth.uid =...
0
votes
0
answers
36
views
Firebase keeps sending me insecurity warnings for my real time database even though my rules prevent root level access
I have a public website that I share with a few of my colleagues and I am using firebase hosting and a real-time database to store my data. Below you will see my security rules. Firebase keeps sending ...
0
votes
0
answers
27
views
Firebase Rules : How to get and compare fileds values from collections
I want to write rules, where user after login can read all instruments and holders only which are contains the same "companyName" and compare in all collection of authInfo, and get value of ...
0
votes
1
answer
17
views
Firebase Security Rules for Realtime database
I am trying to set rules for the firebase Realtime Database. Rules are set to
"rules": {
".read": true,
".write": true
}
This makes it public but I want to set it to ...
0
votes
1
answer
16
views
comparing request.time to value set using toMillis() in firestore rules?
I have the following code and I want to compare 2 values and set rules accordingly, but apparently there is no consistency between the two, at least the comparation is not working issue was I want to ...
0
votes
0
answers
13
views
I'm curious about the method of fire base security rules
This is my firebase rule.
{
"rules":{
"users":{
".write":"auth.provider == 'anonymous' || auth.token.email.endsWith('dev@email.com')",
&...
0
votes
2
answers
64
views
Invalid hashing in Firebase Cloud Storage Rules Playground
I am testing hashing in the rules playground:
This returns "CRexOpCRkV1UtjNvRZCVOczkUrNmGyHzhkGKJXiDswo=", the correct hash of the string "SECRET" :
let expected = hashing.sha256(&...
0
votes
1
answer
15
views
Firestore security rules - trouble with permission to write to a collection
I've attempted to set up a security rule where a person writing a document to a particular collection may only do so if their uid matches the uid contained in the document, but can't get it to work. ...
0
votes
0
answers
23
views
How to use a value from a specific field for security rules for firebase realtime database?
My database schema is shown below:
{
"Shifts":{
"ShiftID":{
"name":"name",
"place":"place",
"ID&...
0
votes
1
answer
32
views
Firebase rules don't allow access
So my flutter code works fine until I change my Firebase Realtime Database rules. It does not throw an error in debug console or anything, but the app does not get the data. I attach my rules and the ...
0
votes
0
answers
40
views
User Access Roles In Firestore
I have Firestore setup as shown in the images below.
I am trying ensure that a user can only have access to projects of a specific company provided the user is authenticated (email and password), ...
0
votes
1
answer
25
views
Using Firebase Security Rules from a web server
Do any of the Firebase Node/JS SDKs support making calls to Firestore from a node server or cloud functions (e.g. nextjs, remix) on a users behalf, respecting security rules for the authenticated user ...
1
vote
1
answer
26
views
The method "collection" isn't defined for the type FirebaseStorage
I'm getting an error trying to store data in firestore. Another issue is using my emulator in android studio ( pixel 5 ) or even all my 4 connected devices. I can run but they all show nothing. ...
0
votes
1
answer
14
views
In Firestore security rules, does doing request.resource.data() account for first time writes?
match /databases/{database}/documents
{
match /users/{theuser=**}
{
match /prescriptions/{prescriptions}
{
allow read, write: if
(request.resource.data....
0
votes
0
answers
29
views
Firebase security rules with Facebook and Twitter APIs
i have android app with used Firebase as database, there are security rules should be added in Firebase platform, i tried to them, but when i added the below code, the app dont work good with Facebook/...
2
votes
1
answer
78
views
flutter app suddenly can't fetch data from firestore, Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
i've been searching for a lot of problem that relate with this but i still didn't find the solution
the error say
Accessing hidden method Ldalvik/system/CloseGuard;->warnIfOpen()V (greylist,core-...
0
votes
0
answers
9
views
firebase keep warning me about my database's rules
I need to set the database's rules: these are my rules :
".read": "auth.token.enabled === true",
".write": "auth.token.enabled === true"
}
Why does ...
0
votes
1
answer
17
views
Firebase console security & Firestore rules best practices
Looking for best practices info on securing Firebase console. I'm building an application with sensitive data in Firestore. We've got good rules around client access - but my concern is how to secure ...
0
votes
2
answers
33
views
How to achieve control over a firestore sub-collection depending on a field in a parent collection without using get()?
I have this code below that is working, but it causes extra reads in my code, I am getting the value that is stored inside the data collection (premiumUntill) in order to allow/block Crud in to sub ...
1
vote
0
answers
27
views
How to get the value of a Firestore security rules array-contains constraint for LIST type query?
I am making a query like db.collection('accounts').where('access.users', 'array-contains', [ user1.ref ])
user1.ref is a DocumentReference to a document in the users collection that enables this user ...
0
votes
1
answer
10
views
Firestore security rules - how to secure LIST requests by request.query checks on ACL access control list?
I want to secure a collection of accounts documents with a field access.users that contains an array of user DocumentReferences which are allowed to access an account document in the collection.
...
0
votes
0
answers
44
views
How do I set firebase security rule
I am using firebase real time database. I have an application where users can share posts on the homepage, comment and like on posts, give each other points and comments, and message each other. Users ...
0
votes
0
answers
29
views
FirebaseError: Missing or insufficient permissions. security Rules
I'm trying to set security rules for my test app here i heve users collection in my cloud firestore and and total of 4 documents and all i want that is only authenticate users and the user only access ...
0
votes
0
answers
32
views
Troubleshoot simple custom firebase security rules function
I'm writing a custom cloud function (official documentation) in Firestore security rules that checks to make sure the submitting user is the content owner, per the official documentation.
I'm applying ...
0
votes
1
answer
18
views
was working well but FirebaseException ([cloud_firestore/permission-denied] The caller does not have permission to execute the specified operation.)
I have been working on the Flutter app with firebase and the app was working well but today when I trying to retrieve the data from using snapshot I got this exception.
FirebaseException ([...
-1
votes
0
answers
33
views
Firestore Uncaught (in promise) FirebaseError: Missing or insufficient permissions. For delete method [closed]
Try to delete record from firebase firestore but got a Permission error
HERE IS THE APP CODE
const deleteFile = async () => {
database.files.where("name", "==", ...
0
votes
1
answer
25
views
How to make Firebase Realtime Database connected to ESP8266 safe
I'm planning on releasing a project that involves an ESP8266 connecting to a realtime database in Firebase. People will build the project, upload the code to their ESP8266 and download a Flutter ...
0
votes
1
answer
29
views
How is not using Firebase Security Rules a security risk?
I have a nextjs application and I'm using firebase databse. I have not added security rules as I'm not using authentication.
I'm hosting on vercel and my firebase config is stored in environment ...
0
votes
1
answer
16
views
How to conditionally retrieve current user's doc fields in Firestore
I need to conditionally retrieve fields of current user's doc. Here is my Firestore db structure.
I need all map type objects (setup1, setup2, setup3...) and their fields, nothing else.
It is ...
0
votes
0
answers
27
views
Get the last document and rate limit the client to one write every 5 minutes in cloud firestore
I have these values stored in documents inside a collection:
{
value: string,
currValId: number,
chosen: bool,
requestTime: number, // the time the request is sent, in unix milliseconds
...
0
votes
1
answer
28
views
In Firestore security rules, can a custom function be used inside another custom function?
In Firestore security rules, I'm writing a custom function (isEitherNotSecretOrIsOwner()), with another custom function (belongsToRequestor()) inside of it, but the official Google Firebase ...
0
votes
1
answer
26
views
Function not found when converting string to boolean in Firestore security rules
I'm writing a security rule on Firestore that converts a string into a boolean. According to the documentation, we should be able to do it by using the bool function.
I've created the following rule:
...
0
votes
1
answer
46
views
Firestore rules: Property is undefined on object. for 'list' @ L6
I am having an issue where I am trying to query a subquery by a field, and I have tried the emulator as well as firebase support (still on going, but not solutions yet).
When running the following ...
0
votes
1
answer
50
views
Firebase security rules (.read)
I have a question about Firebase Database security rules.
I want only some documents to be reflected in the application.
I tried to create a "published" field in the database, and determine ...
0
votes
0
answers
10
views
How To Restrict Updates On Specific Fields
I am trying to write a security rules that allows all updates/writes for authenticated users, except if they are trying to update "votes" field for any document it must be greater than 0. ...
0
votes
1
answer
17
views
I have accidently revealed my Firebase project credentials and someone started mining crypto on it. How attack was look like?
I have forgot to add to gitignore file, which included:
{
"type":
"project_id": ,
"private_key_id":
"private_key":
"client_email":
&...
0
votes
1
answer
31
views
I am not able to access firebase real-time DB after making them secure
I have authenticated firebase by email/password and make database secure by changing rules but I am not able to access database.
How to set the rule to access database only for authentic user?
...
0
votes
1
answer
25
views
Solve permission-denied with firebase rules
I have 3 Firestore collections, Invoices, Clients, and Infos. I wrote the following rule to allow read and write in Firestore only if the user is authenticated.
rules_version = '2';
service cloud....
0
votes
0
answers
42
views
Firebase firestore has unsecure rules warning - how do I fix is my app doesn't have authentication
My firestore has the following rules:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}
...
0
votes
1
answer
26
views
Firestore Rules for a user to create and edit his data only
I am new to firebase and and I finished building a react.js sire where the user fills a form which is saved under a sub collection called drivers, then the document of the user in users sub collection ...
0
votes
1
answer
26
views
Firebase Realtime Database Allow read/write if string matches an attribute
My firebase realtime database structure:
stores
-store1234
-data
-specialKeyForStore1234
-store4567
-data
-specialKeyForStore4567
-...
My goal:
-data should be public ...
1
vote
0
answers
32
views
Can you set read rules in firestore depending on values in other doc in other collection?
In my app I have 4 collections echo collection has certain set of premium content .
my collections are Data , Weeks , Plans , Shared ...
I am trying to block the reading of data from each collection ...
0
votes
1
answer
36
views
Firebase database expiring - changing rules
My database has due to expire in two days because of rules security. I changed the default test rules yesterday, it is possible that they have not yet been noted, but to make sure they are sufficient ...
0
votes
1
answer
28
views
Preventing a user from adding a different fields when updating a document in firestore?
I am trying to prevent a user from creating spam fields inside a document, fields that are different form that state of the original doc (after it has been created)
my current rules looks like the ...
0
votes
0
answers
33
views
Firestore Security Rules Not Working For a Single Collection
I have the following security rule in firestore.rules, for the explicit purpose of being able to retrieve the emergencycarecontacts by default:
rules_version = '2';
service cloud.firestore {
match /...
0
votes
1
answer
23
views
How to lock updating/deleting a collection created by a user to the same user who created the collection in firestore (without using cloud Functions)?
I have the following model and rules... the first part of the equation is working fine a user can CRUD his own collection that he created, and it has the the same id as the creator.
the issue lies in ...