Common rule patterns in Firebase - Mini Project: Build & Apply

Firebase Security Rules: Common Rule Patterns

📖 Scenario: You are building a simple Firebase Firestore database for a small blog app. You want to protect your data by writing security rules that control who can read and write posts.

🎯 Goal: Write Firebase security rules using common patterns to allow authenticated users to read all posts, but only allow users to create and update their own posts.

📋 What You'll Learn

Create a rules_version declaration with value '2'

Define a service cloud.firestore block

Allow read access to all documents in the posts collection for authenticated users

Allow write access only if the user is authenticated and the request.auth.uid matches the userId field in the document

Use common rule patterns like allow read: if request.auth != null; and allow write: if request.auth != null && request.auth.uid == resource.data.userId;

💡 Why This Matters

🌍 Real World

Firebase security rules protect your Firestore data from unauthorized access and changes, which is essential for any app with user-generated content.

💼 Career

Understanding and writing Firebase security rules is a key skill for cloud developers and backend engineers working with Firebase and Google Cloud.

1

Set up the basic rules structure

Create a Firebase security rules file starting with rules_version = '2'; and define the service cloud.firestore block with an empty match /databases/{database}/documents block.

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Your code here
  }
}

Hint

Start by declaring the rules version and the Firestore service block.

2

Add read access for authenticated users

Inside the match /databases/{database}/documents block, add a match /posts/{postId} block. Inside it, allow read access only if request.auth != null.

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      // Your code here
    }
  }
}

Hint

Use allow read: if request.auth != null; to permit reads only for signed-in users.

3

Add write access only for owners

Inside the match /posts/{postId} block, add a rule to allow write access only if the user is authenticated and their request.auth.uid matches the userId field in the existing document (resource.data.userId).

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow read: if request.auth != null;
      // Your code here
    }
  }
}

Hint

Check that the user is signed in and owns the post by comparing request.auth.uid with resource.data.userId.

4

Allow creating posts with user ownership

Modify the allow write rule to also allow creating new posts if the user is authenticated and the request.resource.data.userId matches request.auth.uid. This allows users to create posts where they are the owner.

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow read: if request.auth != null;
      // Your code here
    }
  }
}

Hint

Use request.resource.data.userId to check ownership on new documents and resource.data.userId for existing documents.

Practice

1. What is the main purpose of Firebase security rules in a database?

easy

A. To control who can read or write data

B. To speed up database queries

C. To store user passwords securely

D. To backup data automatically

Solution

1. Step 1: Understand Firebase security rules role

   Firebase security rules define who can access or change data in your database.

2. Step 2: Identify the main function

   The main function is to control read and write access to protect data.

3. Final Answer:

   To control who can read or write data -> Option A

4. Quick Check:

   Security rules = access control [OK]

Hint: Rules control data access permissions quickly [OK]

Common Mistakes:

• Confusing rules with data backup
• Thinking rules speed up queries
• Assuming rules store passwords

2. Which of the following is the correct syntax to allow only authenticated users to read data in Firebase rules?

easy

A. allow read: if request.auth != null;

B. allow read: if user.loggedIn == true;

C. allow read: if auth.user == true;

D. allow read: if request.user != null;

Solution

1. Step 1: Identify correct Firebase auth syntax

   Firebase uses request.auth to check if a user is authenticated.

2. Step 2: Match syntax to allow read only if authenticated

   The correct condition is request.auth != null meaning user is logged in.

3. Final Answer:

   allow read: if request.auth != null; -> Option A

4. Quick Check:

   request.auth != null means user logged in [OK]

Hint: Use request.auth to check user authentication [OK]

Common Mistakes:

• Using incorrect variable names like user.loggedIn
• Checking auth.user instead of request.auth
• Confusing request.user with request.auth

3. Given this Firebase rule snippet:

allow write: if request.auth.uid == resource.data.ownerId;

What does this rule enforce?

medium

A. No one can write to the data

B. Only the owner of the data can write to it

C. Anyone can write if authenticated

D. Only admins can write to the data

Solution

1. Step 1: Understand the condition in the rule

   The rule checks if the user's ID matches the ownerId stored in the data.

2. Step 2: Interpret the effect of the condition

   This means only the user who owns the data (ownerId) can write to it.

3. Final Answer:

   Only the owner of the data can write to it -> Option B

4. Quick Check:

   request.auth.uid == resource.data.ownerId means owner only [OK]

Hint: Match request.auth.uid with data ownerId to allow write [OK]

Common Mistakes:

• Assuming all authenticated users can write
• Thinking admins are required
• Believing no one can write

4. Identify the error in this Firebase rule snippet:

allow read: if request.auth.uid = resource.data.ownerId;

medium

A. request.auth.uid is not a valid property

B. Missing semicolon at the end of the line

C. Using single equals (=) instead of double equals (==) for comparison

D. resource.data.ownerId cannot be used in rules

Solution

1. Step 1: Check the comparison operator used

   The rule uses a single equals sign (=) which is assignment, not comparison.

2. Step 2: Correct operator for comparison in Firebase rules

   Firebase rules require double equals (==) to compare values.

3. Final Answer:

   Using single equals (=) instead of double equals (==) for comparison -> Option C

4. Quick Check:

   Use == for comparison, not = [OK]

Hint: Use == to compare values in rules, not = [OK]

Common Mistakes:

• Confusing assignment (=) with comparison (==)
• Thinking semicolon is mandatory
• Believing request.auth.uid is invalid

5. You want to allow users to update their own profile but prevent them from changing their user ID. Which Firebase rule pattern correctly enforces this?

hard

A. allow update: if request.auth.uid == request.resource.data.userId;

B. allow update: if request.resource.data.userId == null;

C. allow update: if request.auth.uid != resource.data.userId;

D. allow update: if request.auth.uid == resource.data.userId && request.resource.data.userId == resource.data.userId;

Solution

1. Step 1: Ensure user can update only their own profile

   The rule must check that the authenticated user matches the existing userId in data.

2. Step 2: Prevent changing the userId field

   Check that the new data's userId matches the old data's userId to prevent changes.

3. Final Answer:

   allow update: if request.auth.uid == resource.data.userId && request.resource.data.userId == resource.data.userId; -> Option D

4. Quick Check:

   Match auth.uid and keep userId unchanged [OK]

Hint: Check auth.uid matches and userId stays same [OK]

Common Mistakes:

• Allowing userId to be changed
• Not verifying user owns the profile
• Using != instead of == for ownership check