CODEWITHSUNDEEP
firebasegoogle-cloud-storagefirebase-storagefirebase-security
Rob
Rob

Reputation: 1579

Do firebase storage rules override cloud storage permissions?

I have the following rules in my bucket:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read;
    }
  }
}

This says to me that public can read - but they can't. Checking on the google cloud storage UI, there is no 'public url'.

So a couple of questions:

​

Upvotes: 2

Views: 386

Answers (2)

Frank van Puffelen
Frank van Puffelen

Reputation: 599686

Cloud Storage access permissions and Firebase's Storage rules are unrelated.

Firebase's Storage rules apply to users who access the data in the bucket through a Firebase SDK. In addition Firebase can generate a so-called download URL, which gives everyone who has that URL read-only access to that file.

Cloud Storage access permissions apply to users accessing the data in the bucket through a Cloud API. The Cloud Storage SDKs and APIs can also generate so-called signed URLs, which serve a similar role to the download URLs mentioned above.

Upvotes: 2

Doug Stevenson
Doug Stevenson

Reputation: 317750

Firebase security rules only affect direct access from web and mobile client apps when using the Firebase SDK, especially when the user is authenticated with Firebase Auth (as the user's account token is made available during the evaluation of rules).

Rule do not affect the way service accounts work, or other forms of public access that depend on Cloud Storage ACLs. Those are determined by their own permission systems. Those other systems don't also don't affect Firebase client access at all.

Upvotes: 2

Related Questions