Can firebase security rules be used to deliver the right data or its only here for malicious users?

Question

Imagine the case I want to request a chat (a document) from two user Ids (user1 and user2).

Chat document contains an array with participants ids so users1 and users2 are both in particiants array.

If I request everything that contains user1 or user2 in participant array I may get user1 chats with other users too, not only user1 with user2.

Code for the example :

 ref.where('participantsIds', 'array-contains-any', [u1.id , u2.id])

Now imagine I add a security rule that only allow getting chats if the user making the request is in participants array.

Rule for example :

 allow read, write: if request.auth!=null && request.auth.uid in resource.data.participantsId

Is this a bad practice? Can I use rules to control data behaviors for each instance of the app?

The rule will probably add some milliseconds (or not even?) to the request no matter if the result is true or false.

And yes I know will affect cost and request quotas.

Thanks !!

Answer 1

Firebase security rules are not filters. They can't change the data that would be returned from a query. All they do is stop people from accessing data based on the logic you supply.

If you apply the rule shown above, then any query where the user requests any document where their uid is not in participantsId, or they make a query that does not use their uid as a required filter on participantsId, then the query will simply fail. This is something that you should pretty easily be able to observe for yourself.

I suggest reading: What does it mean that Firestore security rules are not filters?