Firestore rules - securing data by field

Question

I have a field on my "feed" documents that represents the userId. I want to secure my data such that only the user can read/write feed entries with their own userId. Everything else - allow the user to read/write as long as they are authenticated.

I'm a little new to firestore, but so far I have something like this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /feed/{feedItem} {
        allow read, write: if request.auth.uid == resource.data.userId
    }
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

Unfortunately, this is still allowing read/write access to everything, including feed items.

Doug Stevenson Doug Stevenson · Accepted Answer · 2019-11-25T03:09:41

Those rules are not going to work the way you expect.

Your rule to limit reads and writes on document in the feed collection looks OK, assuming that the field name seen here matches the name of field in the documents.

However, your rule for "everything else" with match /{document=**} is not OK. This rule always matches every document in your entire database, no matter what your other rules are. So, as you have it written right now, every user can still read and write every document, including those in "feed" because that rule always allows it.

It's good to keep in mind the following statements about the way security rules work:

If any rule would allow access to some document, then access will be allowed.
Once access to a document has been allowed by a rule, that access cannot be revoked by another rule.

In fact, security rules don't have a way to specify "everything else" in relation to some other rule. What you'll need to be do instead is call out each collection by name in its own rule, and assigning access to it. Yes, this is cumbersome if you have a lot of collections, but it's your only option.

Firestore rules - securing data by field

1 Answers