Firebase firestore security rules not working

Question

I have a really simple firestore db that looks like the image above.

I want to write a security rule so that only authenticated users can get in, but whatever I write, I always get permission denied.

I have tried:

rules_version = '2';
service cloud.firestore {
  match /users/{user} {
   allow read, write: if request.auth.uid == user
   match / {docs = **} {
      allow read, write: if request.auth.uid == user
   }
 }
}

I also tried:

rules_version = '2';
service cloud.firestore {
 match /users/{user} {
   allow read, write: if request.auth.uid == user
   match / {docs = **} {
      allow read, write: if request.auth.uid == user
   }
 }
}

I also tried:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/{documents=**} {
      allow read, write: if isOwner(userId);
    }
  }

  function isOwner(userId) {
    return request.auth.uid == userId;
  }
}

This does not work:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /sessions/{sessionID} {
      allow read, write: if request.auth != null;
    }
  }
}

Neither does this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /sessions/{sessionsID} {
      allow read, write: if request.auth != null;
    }
  }
}

I can't see the word sessions throughout the post. Or maybe you posted any other screenshot? — Dharmaraj
I haven't used the word sessions in the rules at all - but I thought I was selecting all documents however they were nested in folders? — Davtho1983
Can you give me an example that works for you? All I need is to allow read, write for authenticated users — Davtho1983

Dharmaraj Dharmaraj · Accepted Answer · 2020-05-09T11:33:40

I tried to compare my rules with your database structure.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /sessions/{sessionID=**} {
      allow read, write: if request.auth.uid != null;
    }
}

Now this should allow only registered users to gain access.

Firebase firestore security rules not working

1 Answers