Custom functions in rules in Firebase - Deep Dive

Overview - Custom functions in rules

What is it?

Custom functions in Firebase security rules let you write reusable blocks of code to check conditions for accessing your database or storage. Instead of repeating the same checks everywhere, you write a function once and call it multiple times. This makes your rules cleaner, easier to read, and simpler to maintain. These functions help control who can read or write data based on your app's logic.

Why it matters

Without custom functions, your security rules would be long and repetitive, making mistakes more likely and updates harder. This could lead to security holes or broken app features. Custom functions solve this by letting you write checks once and reuse them, saving time and reducing errors. This keeps your app safe and your rules easy to manage as your app grows.

Where it fits

Before learning custom functions, you should understand basic Firebase security rules syntax and how to write simple allow or deny statements. After mastering custom functions, you can explore advanced rule patterns like recursive rules, complex conditionals, and integrating with Firebase Authentication for fine-grained access control.

Mental Model

Core Idea

Custom functions in Firebase rules are like reusable safety checks you write once and use everywhere to keep your app secure and your rules simple.

Think of it like...

Imagine you have a checklist for locking doors in your house. Instead of writing the full checklist every time you check a door, you write it once on a card and just refer to that card whenever needed. Custom functions are like that checklist card for your security rules.

┌─────────────────────────────┐
│ Firebase Security Rules      │
│                             │
│  ┌───────────────┐          │
│  │ Custom Func   │◄─────────┤
│  └───────────────┘          │
│        ▲                    │
│        │                    │
│  ┌───────────────┐          │
│  │ Rule Checks   │          │
│  └───────────────┘          │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Basics of Firebase Security Rules

Concept: Learn what Firebase security rules are and how they control access to your database or storage.

Firebase security rules are simple scripts that run on Firebase servers to decide if a user can read or write data. They use conditions like checking if a user is signed in or if data matches certain values. For example, a rule might say 'allow read if user is signed in'.

Result

You understand how rules protect your data by allowing or denying access based on conditions.

Knowing the purpose of security rules helps you see why writing clear and correct rules is essential for app safety.

2

Foundation

Writing Simple Conditions in Rules

Concept: Learn how to write basic allow or deny statements with conditions in Firebase rules.

Rules use 'allow' statements with conditions. For example: allow read: if request.auth != null; This means only signed-in users can read data. You can combine conditions with '&&' (and) or '||' (or).

Result

You can write simple rules that control access based on user authentication or data values.

Understanding conditions is the foundation for making rules that fit your app's needs.

3

Intermediate

Introducing Custom Functions in Rules

🤔Before reading on: do you think custom functions can only be used once or multiple times in rules? Commit to your answer.

Concept: Custom functions let you write reusable code blocks inside your rules to avoid repetition.

You define a function inside your rules using 'function' keyword. For example: function isOwner() { return request.auth.uid == resource.data.ownerId; } Then you can use 'isOwner()' in multiple places in your rules.

Result

Your rules become shorter and easier to read because you reuse checks instead of repeating them.

Knowing that functions can be reused helps you write cleaner and less error-prone rules.

4

Intermediate

Passing Parameters to Custom Functions

🤔Before reading on: do you think custom functions in Firebase rules can accept inputs to check different data? Commit to your answer.

Concept: Functions can take parameters to make them flexible for different checks.

You can define functions with parameters like: function canEdit(docOwner) { return request.auth.uid == docOwner; } Then call it with different owner IDs: allow write: if canEdit(resource.data.ownerId);

Result

Functions become more powerful and adaptable to various situations in your rules.

Understanding parameters lets you create general-purpose checks instead of one-off functions.

5

Intermediate

Using Functions for Complex Conditions

🤔Before reading on: do you think functions can combine multiple checks or just one? Commit to your answer.

Concept: Functions can combine several conditions to simplify complex rules.

For example, a function can check if a user is signed in and owns the document: function canAccess(docOwner) { return request.auth != null && request.auth.uid == docOwner; } Use it in rules: allow read, write: if canAccess(resource.data.ownerId);

Result

Your rules become easier to understand and maintain even with complex access logic.

Knowing functions can bundle multiple checks helps manage complexity in security rules.

6

Advanced

Limitations and Best Practices of Functions

🤔Before reading on: do you think custom functions can call other functions or have loops? Commit to your answer.

Concept: Understand what functions can and cannot do in Firebase rules and how to write them efficiently.

Firebase rules functions cannot have loops or call external services. They can call other functions but must be simple and fast. Avoid heavy logic to keep rules performant. Use clear naming and keep functions focused on one task.

Result

You write efficient, maintainable functions that keep your app secure without slowing down access.

Knowing function limits prevents writing rules that Firebase rejects or that cause slow responses.

7

Expert

Advanced Function Patterns and Security

🤔Before reading on: do you think functions can help prevent subtle security bugs in complex apps? Commit to your answer.

Concept: Use functions to enforce consistent security policies and avoid common mistakes in large apps.

In big apps, use functions to centralize checks like user roles, ownership, or data validation. This avoids inconsistencies where one rule forgets a check. Functions also help audit and update security logic quickly. Beware of over-nesting functions which can make debugging harder.

Result

Your app stays secure and easier to update as it grows, reducing risk of accidental data leaks.

Understanding how functions enforce consistent security policies is key to professional Firebase rule design.

Under the Hood

Firebase security rules run on Google's servers whenever a client tries to read or write data. Custom functions are parsed and executed as part of these rules. They are evaluated quickly in a sandboxed environment with no side effects. Functions are inlined during evaluation, meaning their logic replaces the call site to optimize performance. This ensures fast decisions without extra network calls.

Why designed this way?

Firebase rules were designed to be simple, fast, and secure. Allowing custom functions lets developers avoid repeating code, reducing errors. However, to keep rules fast and safe, functions are limited: no loops, no external calls, and no side effects. This design balances flexibility with performance and security.

┌───────────────────────────────┐
│ Client Request (read/write)   │
└───────────────┬───────────────┘
                │
                ▼
┌───────────────────────────────┐
│ Firebase Rules Engine          │
│ ┌───────────────────────────┐ │
│ │ Parse Rules & Functions   │ │
│ │ Inline function calls     │ │
│ │ Evaluate conditions       │ │
│ └───────────────────────────┘ │
│           │                   │
│           ▼                   │
│ Allow or Deny Access          │
└───────────────┬───────────────┘
                │
                ▼
       Data Access Allowed/Denied

Myth Busters - 4 Common Misconceptions

Quick: Do you think custom functions in Firebase rules can perform loops or recursion? Commit to yes or no.

Common Belief: Custom functions can have loops or call themselves recursively to handle complex logic.

Reality: Firebase rules functions do not support loops or recursion. They must be simple and side-effect free.

Why it matters: Trying to use loops or recursion causes rule errors or unexpected behavior, blocking deployment or causing security gaps.

Quick: Do you think custom functions can access external APIs or databases? Commit to yes or no.

Common Belief: Functions in rules can call external services to check permissions dynamically.

Reality: Functions run only inside Firebase rules and cannot call external APIs or databases.

Why it matters: Expecting dynamic external checks leads to insecure rules or failed requests because rules cannot fetch outside data.

Quick: Do you think defining the same logic in multiple places is better than using functions? Commit to yes or no.

Common Belief: Writing repeated conditions directly in each rule is clearer than using functions.

Reality: Repeating logic increases errors and maintenance effort; functions improve clarity and reduce mistakes.

Why it matters: Without functions, updating access logic requires multiple edits, risking inconsistent security.

Quick: Do you think functions can modify data or state in Firebase? Commit to yes or no.

Common Belief: Functions in rules can change data or user state during evaluation.

Reality: Functions are pure checks and cannot modify data or state; they only return true or false.

Why it matters: Misunderstanding this can lead to expecting side effects that never happen, causing logic errors.

Expert Zone

1

Functions are evaluated every time a rule runs, so keeping them efficient avoids slowing down data access.

2

Functions can call other functions, but deep nesting can make debugging rules difficult and obscure error messages.

3

Using functions to centralize role checks or ownership logic prevents subtle security bugs in large, complex apps.

When NOT to use

Avoid using custom functions when your logic requires loops, recursion, or external data fetching. Instead, handle complex logic in your app backend or Cloud Functions and keep rules simple for fast evaluation.

Production Patterns

In production, developers use functions to enforce consistent ownership checks, role-based access, and data validation. They often organize functions at the top of the rules file for clarity and reuse. Functions also help when multiple collections share similar access patterns.

Connections

Functions in Programming Languages

Custom functions in Firebase rules are a simplified form of functions in programming languages.

Understanding how functions encapsulate reusable logic in programming helps grasp why Firebase rules use functions to avoid repetition and improve clarity.

Access Control Lists (ACLs)

Custom functions help implement ACL-like checks inside Firebase rules.

Knowing ACLs from traditional security models clarifies how functions centralize permission checks for users and roles.

Mathematical Logic

Functions in rules express logical conditions that must be true for access.

Recognizing that rules are logical expressions helps understand how functions combine conditions with AND, OR, and NOT to enforce security.

Common Pitfalls

#1 Repeating the same condition in multiple rules without using functions.

Wrong approach:

allow read: if request.auth.uid == resource.data.ownerId;
allow write: if request.auth.uid == resource.data.ownerId;

Correct approach:

function isOwner() {
return request.auth.uid == resource.data.ownerId;
}
allow read: if isOwner();
allow write: if isOwner();

Root cause:

Not knowing functions can reuse logic leads to duplicated code and harder maintenance.

#2 Trying to use loops inside a custom function to check multiple conditions.

Wrong approach:

function checkAll() {
for (let i = 0; i < 5; i++) {
if (someCondition(i)) return false;
}
return true;
}

Correct approach:

function checkCondition1() { return ...; }
function checkCondition2() { return ...; }
function checkAll() {
return checkCondition1() && checkCondition2();
}

Root cause:

Misunderstanding that Firebase rules do not support loops or iteration.

#3 Expecting functions to modify data or perform side effects.

Wrong approach:

function updateFlag() {
resource.data.flag = true;
return true;
}

Correct approach:

function isFlagSet() {
return resource.data.flag == true;
}

Root cause:

Confusing rules functions with programming functions that can change state.

Key Takeaways

Custom functions in Firebase rules let you write reusable, clear checks to control data access.

They help avoid repeating the same logic, making rules easier to read and maintain.

Functions cannot have loops, recursion, or side effects; they only return true or false based on conditions.

Using functions to centralize security checks reduces bugs and keeps your app safe as it grows.

Understanding function limits and best practices ensures your rules stay fast, secure, and manageable.