Access url without token in Firebase Storage

Question

I have a firebase storage download url, like

https://firebasestorage.googleapis.com/v0/b/siren-5eee7.appspot.com/o/profile%2FC6jNlR0F4cZBPv7wF0REWUNVor33?alt=media&token=63a9130e-2ba6-4f38-ac3f-2231c54a1043

How can I access this url without token parameter?

For example, If I access above url without token there will be 403 error showing permisson denied.

My firebase storage secure rule is below :

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

This file located in /etc file. How can I do it?

Answer 1

try changing rule:

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read;
      allow write: if request.auth != null;
    }
  }
}

Answer 2

In case you need the rule to allow accessing only the images without a token you have to do the following:

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read: if request.auth!=null || resource.contentType.matches('image/.*');
      allow write: if request.auth!=null;
    }
  }
}

Answer 3

From what I understand, you're trying to make the whole bucket publicly available. Using Firebase access rules might not be best, you might want to make the bucket read access available via Google Cloud's Storage layer.

To do that, one of the easiest way is using the Google Cloud Console Storage.

Select the bucket, click the bucket to configure and open the permissions tab. Since this is Firebase managed bucket, it would have what Google called fine-grained access control. Don't worry, adding public access is quite simple. Click Add members button, then, on the sidebar, add in allUser as new member, and give it the role of Storage > Storage Object Viewer. You can see more detail in the Storage Docs.

This will make the bucket publicly viewable via <bucketname>.storage.googleapis.com. If you created extra bucket in Firebase that match a domain you own and verified in Google Search Console, you can create a bucket of named after your custom domain and have it publicly accessible using a CNAME of the custom domain that points to c.storage.googleapis.com. You can see more detail at Storage Endpoints Docs, Google Cloud's docs explain it much better than I can. Hope this helps!