CODEWITHSUNDEEP
iosgoogle-cloud-firestorefirebase-security
Linus Bicker
Linus Bicker

Reputation: 129

Swift and Firestore security rules, firebase security

I'm new developer working on my first Firestore app. I've changed the rules on Firestore to make the data more secure for user, but it's not allowing read/write.

This is the key line and I don't know how to configure it specific to my app -

    match /some_collection/{userId}/{documents=**} {

I don't know if I change the "some_collection" to my collection name or if some_collection in that sense is an actual wildcard type of parameter itself.

Also, do I need to pass in the userID somehow from my swift application to Firestore? where is userID coming from in this line? I'd prefer to make the rule such that only the user who created the data can read/write. I believe this block is to allow any authenticated user, so I'm just trying to explore each step.

   service cloud.firestore {
      match /databases/{database}/documents {
        // Allow only authenticated content owners access
           match /some_collection/{userId}/{documents=**} {
           allow read, write: if request.auth != null && request.auth.uid == userId
         }
      }
    }

Upvotes: 1

Views: 767

Answers (1)

Antonio Ramirez
Antonio Ramirez

Reputation: 1058

Addressing your questions:

This is the key line and I don't know how to configure it specific to my app.
match /some_collection/{userId}/{documents=**}
I don't know if I change the "some_collection" to my collection name or if some_collection in that sense is an actual wildcard type of parameter itself.

In the line above "some_collection" is not a firestore wildcard and you need to replace some_collection with the actual value of your collection.

Also, do I need to pass in the userID somehow from my swift application to Firestore?

Yes and it is expected that before reading or writing to/from firestore:

  1. You had already created and configured the firebase object.

    firebase.initializeApp({
    apiKey: '### FIREBASE API KEY ###',
    authDomain: '### FIREBASE AUTH DOMAIN ###',
    projectId: '### CLOUD FIRESTORE PROJECT ID ###'
    });

  2. You had already authenticated your users with firebase auth.

    firebase.auth().signInWithCustomToken(token)
    .then((user) => {
    // Signed in
    // ...
    })
    .catch((error) => {
    var errorCode = error.code;
    var errorMessage = error.message;
    // ...
    });

Passing the userId is done by the firebase object when you call db. collection(“col123”).add or any other method. If you look at how firestore is initialized:

var db = firebase.firestore();

You will see its dependency with the firebase object.

where is userID coming from in this line?

The userID is coming from the firebase object.

I believe this block is to allow any authenticated user, so I'm just trying to explore each step.

Yes, the last rules allow any authenticated user to read and write from/to the subcollections/documents wildcard {userId}.

Lastly it is also expected that there is some naming consistency in the ids of your firestore documents or subcollections.
This means when you create firestore documents, use the firebase.auth.uid as the document id.
Otherwise, the rule from above will fail because the value behind {userId} is not equal to firebase.auth.uid of the logged user.
To achieve the latter, you can refer to this answer.
I highly recommend you have a look at this video(from the firebase channel) since it elaborates more on the core concepts of firestore security rules.

I hope you find this useful.

Upvotes: 2

Related Questions