Firestore security rules: allow access to one specific user

Question

I have a production and a sandbox Firestore databases and a common firestore.rules file.
I want only one user per database to be allowed to read and write.

I've currently using this configuration for the security rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  
    function isAdmin(uid) {
      return uid == "IKHXrLmfIFZvrimpJUwnfUzTUoE2" 
      || uid == "xVTByGu49XX3rOdNYMKf2Bzt5bY2";
    }
    
    match /{document=**} {
      allow read, write: if isAdmin(request.auth.uid)
    }
  }
}

The first uid is the demo user (which exists only in the sandbox firebase project) and the second one is the admin user of the production database (which exists only in the production project)

Details:

The codebase is open
The sandbox database has public api key and demo user credentials (free plan).
The production database is private, api key and admin credential are protected.

I am aware that publishing the sandbox API key is not the best, but it's not an important database.
The important thing is that the production database remains safe.

Are there any security issues using this method? If yes, how can I protect the production database?

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2021-01-03T19:25:37

I use this approach all the time when I first start on a project. I create an initial (anonymous) user, and give that one extensive permission in the security rules.

Since you'd need the project's service credentials to be able to set the same UID at will on my project, this approach is secure and allows me to get started quickly.

Then when I'm ready for a more extensive security system I extend the security model, typically on one of these:

By allowing all users from a specific domain administrative access.
By creating a list of admin UIDs in the database, and checking that in my rules.
By adding a custom claim isAdmin to the user's token, and check that in the security rules.

But even at that point, I tend to leave the hard-coded UIDs in place, as they are no security risk.

Firestore security rules: allow access to one specific user

1 Answers