Firestore Android Java -- How to get user document with Security Rules?

Question

I believe my security rules and code is correct, but I am getting a permission error in Android studio when I try to retrieve from the user document...

This is the Get User Profile method in my Android java code:

public void getUserProfile(){
    db.collection("users")
            .get()
            .addOnCompleteListener(new OnCompleteListener<QuerySnapshot>() {
                @Override
                public void onComplete(@NonNull com.google.android.gms.tasks.Task<QuerySnapshot> task) {
                    if (task.isSuccessful()) {
                        for (QueryDocumentSnapshot document : task.getResult()) {
                            String displayName = document.getString("DisplayName");
                            String userEmail = user.getEmail();
                        }

                    } else {
                        Log.w("DEBUG_FirestoreActivity", "Error getting documents.", task.getException());
                    }
                }
            });
}

... and this is how my security rules are set up:

    match /users/{userId} {
  allow read, write: if request.auth != null && request.auth.uid == userId;}

Here is the output of the error I'm receiving in android studio:

com.google.firebase.firestore.FirebaseFirestoreException: PERMISSION_DENIED: Missing or insufficient permissions.

What's strange is that everything should work, and I have tested it with the Rules Playground.

Here is the output of the error I'm receiving in android studio: com.google.firebase.firestore.FirebaseFirestoreException: PERMISSION_DENIED: Missing or insufficient permissions. — robin.cormie
Please don't add additional information in comments. There's an edit link under your question, so you can add it there (as I just did). — Frank van Puffelen

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2021-03-26T00:51:55

Your security rules allow each user to read their own document. But your code is trying to read the documents of all users, and is thus rejected.

Note that security rules are not filters on their own. If you want to only read the current user's document, you need to do so from the code: the security rules won't do this for you.

For example:

db.collection("users")
  .doc(FirebaseAuth.getInstance().getCurrentUser().getUid())
        .get()

Firestore Android Java -- How to get user document with Security Rules?

1 Answers