Getting a client URL to Firebase Cloud Storage that comply with storage rules

0
votes

I have a web application on Firebase where I create a Firestore document with a reference to a Firebase Storage file.

I've setup rules on Firebase Storage to only allow read: if request.auth != null.

Since Firestore complies with similar rules I am able to ensure that access to my Firestore document is only possible, when a user is authenticated, but how do I best about enforcing the same rule in my web application to the Firebase Storage file?

  1. I can use getDownloadUrl() when I've uploaded the file and store the URL in my Firestore document. - But URL is always public to anyone
  2. I can create a Firebase Function that on each request checks authentication and if authenticated, generate a getSignedUrl() with an expiration of say 5 minutes and then do a 302 redirect to the temp public URL - but that does not comply with Firebase Storage rules so I need to replicate any new rulesets in the function

Why can't Firebase Storage not simply behave like Firestore and check the auth on a http request and return the file is it complies with rules?

Am I totally missing a 3) and better option to make sure a user is logged in before accessing a file from storage?

1
firebasegoogle-cloud-firestoregoogle-cloud-storagefirebase-storage

1 Answers

0
votes

I can use getDownloadUrl() when I've uploaded the file and store the URL in my Firestore document. - But URL is always public to anyone

It may not be very clear from the documentation, but that's exactly the way download URLs were designed to work.

Why can't Firebase Storage not simply behave like Firestore and check the auth on a http request and return the file is it complies with rules?

It behaves like that when you use the provided client SDK to download files (not using download URLs). Unfortunately, the web SDK doesn't have a file download API (while Android and iOS do).

If you would like to file a feature request for the web SDK, that should go to Firebase support. For now, you have to use download URLs, which are publicly accessible. Or you can create your own backend endpoint that verifies an auth token provided by the client using the Firebase Admin SDK. The backend code can decide if the user should get be able to get the file contents.