CODEWITHSUNDEEP
firebase-authenticationfirebase-storagefirebase-security
Harsh Gaur
Harsh Gaur

Reputation: 132

Firebase Storage security rules playground "Simulated read denied"

I want my user to be able to read and write only his own data but. When I test the rules, I get the message "Simulator read denied". Please tell where i am wrong? Thanks for your time.

Here the some information :

RULES

service firebase.storage {
  // Only a user can upload their file, but anyone can view it
  match /users/{userId}/{fileName} {
    allow read ;
    allow write: if request.auth != null && request.auth.uid == userId;
  }
}

LOCATION

/b/online-notepad-d43d2.appspot.com/o/WkqtgpdUYRUGOBaAfmCByXtVPoT2/file1.txt

PROVIDER

"password"

FIREBASE UID

WkqtgpdUYRUGOBaAfmCByXtVPoT2

EMAIL

[email protected]

EMAIL VERIFIED

true

Authentication payload

{
  "uid": "WkqtgpdUYRUGOBaAfmCByXtVPoT2",
  "token": {
    "sub": "WkqtgpdUYRUGOBaAfmCByXtVPoT2",
    "aud": "online-notepad-d43d2",
    "email": "[email protected]",
    "email_verified": true,
    "firebase": {
      "sign_in_provider": "password"
    }
  }
}

SCREENSHOT

exact location i am using : "/WkqtgpdUYRUGOBaAfmCByXtVPoT2/file1.txt" and one more thing i upload this folder and file from upload button. not from POST request.

enter image description here

enter image description here

enter image description here

After changing rules still getting same result 😥

enter image description here

enter image description here

enter image description here

STILL GETTING SAME RESULT :(

enter image description here

enter image description here

enter image description here

enter image description here

Upvotes: 2

Views: 733

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598887

Here you define two completely separate clauses:

allow read ;
allow write: if request.auth != null && request.auth.uid == userId;

So you have an empty read clause, and a non-empty write clause.

You probably want to use:

allow read, write: if request.auth != null && request.auth.uid == userId;

Edit for second problem: as you said in your edit, you are accessing the path /WkqtgpdUYRUGOBaAfmCByXtVPoT2/file1.txt, but your rules only define access permissions for match /users/{userId}/{fileName}. Since you are only allowing access in /users/... and the path you try to use is not in /users, the access is denied by the rules.

Upvotes: 2

Related Questions