Firebase Security Rules – 5 Bonus Security Template

Firebase Security Rules are essential for controlling access to your data and protecting your Firebase application. In this guide, we’ll cover what security rules are, why they are critical, and how to write and implement them effectively. You’ll learn to configure Firebase Security Rules to ensure only authenticated users can access specific data, prevent unauthorized access, and protect your app from malicious users.

Why Firebase Security Rules Are Essential

Firebase Security Rules provide a way to protect your app’s data by enforcing rules at the database and storage levels. They allow you to control who can read and write data, based on conditions you set. Without security rules, your app’s data could be exposed to unauthorized access, leading to data breaches and security vulnerabilities.

Important Note: Firebase’s default rules are set to allow read, write: if false;, which restricts all access. For development purposes, you might change it to if true;, but this must be adjusted to stricter rules before deployment.

Getting Started with Firebase Security Rules

1. Writing Basic Rules

To set up security rules, navigate to the Firebase Console, go to your project, and click on Firestore Database or Realtime Database. Here, you’ll find the Rules tab where you can edit the rules.

The basic syntax of a rule is as follows:

service cloud.firestore {
  match /databases/{database}/documents {
    match //{document} {
      allow read, write: if ;
    }
  }
}

For example, to allow all authenticated users to read and write to a collection, you would use:

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null;
    }
  }
}

2. Authenticating Users with Firebase Security Rules

To restrict access based on authentication, Firebase provides the request.auth object, which represents the user’s authentication status. By checking if request.auth != null, you can ensure only authenticated users can access your data.

Here’s how to allow authenticated users to read from a collection, but restrict write permissions to the document owner:

service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow read: if request.auth != null;
      allow write: if request.auth.uid == resource.data.ownerId;
    }
  }
}

In this example:

• Read: Any authenticated user can read data from the “posts” collection.
• Write: Only the user who created the post (the owner) can edit or delete it.

Defining Complex Conditions in Security Rules

Firebase Security Rules can also handle complex conditions to protect sensitive data. For instance, if you want to restrict access based on both authentication and specific fields within the data, you can layer conditions.

Example: Restricting Access Based on Roles

Let’s say you have a “users” collection with a role field. You want to allow only admins to access certain documents. Here’s how you can structure the rule:

service cloud.firestore {
  match /databases/{database}/documents {
    match /adminData/{docId} {
      allow read, write: if request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin";
    }
  }
}

Pro Tip: Avoid nesting too many rules within a document. Instead, break them into separate collections or sub-collections to ensure clear and manageable rule structures.

Protecting Firebase Storage with Security Rules

In Firebase Storage, rules are similar but structured to protect your files. Here’s an example of a basic rule that allows only authenticated users to upload or download files.

service firebase.storage {
  match /b/{bucket}/o {
    match /user_uploads/{userId}/{allPaths=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

In this case, only authenticated users can access the “user_uploads” directory, and each user can only access their specific folder.

Adding Timestamp Restrictions

In some cases, you might want to limit access to recent data. For example, you can restrict write access to documents that are no older than a certain timeframe by leveraging timestamps.

allow write: if request.time < resource.data.timestamp + duration.value(24, "h");

Testing Firebase Security Rules

Before deploying, it’s crucial to test your security rules. Firebase provides a built-in Rules Simulator to test read and write conditions.

For comprehensive testing, however, you might consider Firestore Emulator, which lets you test complex rules in a local environment. You can find more details on testing in Firebase Documentation.

5 Bonus Security Templates

Below you can find 5 different security templates for 5 different conditions that I have carefully prepared for you.

Template 1: Basic Authentication Requirement

This rule ensures only authenticated users can read or write data in a specific collection, providing a simple and effective way to secure data access.

service cloud.firestore {
  match /databases/{database}/documents {
    match /protectedData/{docId} {
      allow read, write: if request.auth != null;
    }
  }
}

Template 2: User-Based Access Control

Restricts read and write permissions to a specific user based on their unique ID. This is useful for data that should be accessible only to the owner.

service cloud.firestore {
  match /databases/{database}/documents {
    match /user_data/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

Template 3: Role-Based Access for Admins

Allows only users with an admin role to access specific data. This template is great for creating admin dashboards or restricting sensitive operations to privileged users.

service cloud.firestore {
  match /databases/{database}/documents {
    match /admin_data/{docId} {
      allow read, write: if request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin";
    }
  }
}

Template 4: Timestamp-Based Write Restriction

Only allows write access within a specific timeframe. This rule can limit changes to data based on conditions like time-sensitive operations or session validity.

service cloud.firestore {
  match /databases/{database}/documents {
    match /time_sensitive_data/{docId} {
      allow write: if request.auth != null && request.time < resource.data.timestamp + duration.value(24, "h");
    }
  }
}

Template 5: Public Read, Authenticated Write

This template allows public read access but restricts write permissions to authenticated users. Useful for public data where only verified users can make changes.

service cloud.firestore {
  match /databases/{database}/documents {
    match /public_data/{docId} {
      allow read: if true;
      allow write: if request.auth != null;
    }
  }
}