Custom functions in rules in Firebase - Deep Dive

Overview - Custom functions in rules

What is it?

Custom functions in Firebase security rules let you write reusable blocks of code to check conditions for accessing your database or storage. Instead of repeating the same checks everywhere, you write a function once and call it multiple times. This makes your rules cleaner, easier to read, and simpler to maintain. These functions help control who can read or write data based on your app's logic.

Why it matters

Without custom functions, your security rules would be long and repetitive, making mistakes more likely and updates harder. This could lead to security holes or broken app features. Custom functions solve this by letting you write checks once and reuse them, saving time and reducing errors. This keeps your app safe and your rules easy to manage as your app grows.

Where it fits

Before learning custom functions, you should understand basic Firebase security rules syntax and how to write simple allow or deny statements. After mastering custom functions, you can explore advanced rule patterns like recursive rules, complex conditionals, and integrating with Firebase Authentication for fine-grained access control.

Mental Model

Core Idea

Custom functions in Firebase rules are like reusable safety checks you write once and use everywhere to keep your app secure and your rules simple.

Think of it like...

Imagine you have a checklist for locking doors in your house. Instead of writing the full checklist every time you check a door, you write it once on a card and just refer to that card whenever needed. Custom functions are like that checklist card for your security rules.

┌─────────────────────────────┐
│ Firebase Security Rules      │
│                             │
│  ┌───────────────┐          │
│  │ Custom Func   │◄─────────┤
│  └───────────────┘          │
│        ▲                    │
│        │                    │
│  ┌───────────────┐          │
│  │ Rule Checks   │          │
│  └───────────────┘          │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Basics of Firebase Security Rules

Concept: Learn what Firebase security rules are and how they control access to your database or storage.

Firebase security rules are simple scripts that run on Firebase servers to decide if a user can read or write data. They use conditions like checking if a user is signed in or if data matches certain values. For example, a rule might say 'allow read if user is signed in'.

Result

You understand how rules protect your data by allowing or denying access based on conditions.

Knowing the purpose of security rules helps you see why writing clear and correct rules is essential for app safety.

2

Foundation

Writing Simple Conditions in Rules

Concept: Learn how to write basic allow or deny statements with conditions in Firebase rules.

Rules use 'allow' statements with conditions. For example: allow read: if request.auth != null; This means only signed-in users can read data. You can combine conditions with '&&' (and) or '||' (or).

Result

You can write simple rules that control access based on user authentication or data values.

Understanding conditions is the foundation for making rules that fit your app's needs.

3

Intermediate

Introducing Custom Functions in Rules

🤔Before reading on: do you think custom functions can only be used once or multiple times in rules? Commit to your answer.

Concept: Custom functions let you write reusable code blocks inside your rules to avoid repetition.

You define a function inside your rules using 'function' keyword. For example: function isOwner() { return request.auth.uid == resource.data.ownerId; } Then you can use 'isOwner()' in multiple places in your rules.

Result

Your rules become shorter and easier to read because you reuse checks instead of repeating them.

Knowing that functions can be reused helps you write cleaner and less error-prone rules.

4

Intermediate

Passing Parameters to Custom Functions

🤔Before reading on: do you think custom functions in Firebase rules can accept inputs to check different data? Commit to your answer.

Concept: Functions can take parameters to make them flexible for different checks.

You can define functions with parameters like: function canEdit(docOwner) { return request.auth.uid == docOwner; } Then call it with different owner IDs: allow write: if canEdit(resource.data.ownerId);

Result

Functions become more powerful and adaptable to various situations in your rules.

Understanding parameters lets you create general-purpose checks instead of one-off functions.

5

Intermediate

Using Functions for Complex Conditions

🤔Before reading on: do you think functions can combine multiple checks or just one? Commit to your answer.

Concept: Functions can combine several conditions to simplify complex rules.

For example, a function can check if a user is signed in and owns the document: function canAccess(docOwner) { return request.auth != null && request.auth.uid == docOwner; } Use it in rules: allow read, write: if canAccess(resource.data.ownerId);

Result

Your rules become easier to understand and maintain even with complex access logic.

Knowing functions can bundle multiple checks helps manage complexity in security rules.

6

Advanced

Limitations and Best Practices of Functions

🤔Before reading on: do you think custom functions can call other functions or have loops? Commit to your answer.

Concept: Understand what functions can and cannot do in Firebase rules and how to write them efficiently.

Firebase rules functions cannot have loops or call external services. They can call other functions but must be simple and fast. Avoid heavy logic to keep rules performant. Use clear naming and keep functions focused on one task.

Result

You write efficient, maintainable functions that keep your app secure without slowing down access.

Knowing function limits prevents writing rules that Firebase rejects or that cause slow responses.

7

Expert

Advanced Function Patterns and Security

🤔Before reading on: do you think functions can help prevent subtle security bugs in complex apps? Commit to your answer.

Concept: Use functions to enforce consistent security policies and avoid common mistakes in large apps.

In big apps, use functions to centralize checks like user roles, ownership, or data validation. This avoids inconsistencies where one rule forgets a check. Functions also help audit and update security logic quickly. Beware of over-nesting functions which can make debugging harder.

Result

Your app stays secure and easier to update as it grows, reducing risk of accidental data leaks.

Understanding how functions enforce consistent security policies is key to professional Firebase rule design.

Under the Hood

Firebase security rules run on Google's servers whenever a client tries to read or write data. Custom functions are parsed and executed as part of these rules. They are evaluated quickly in a sandboxed environment with no side effects. Functions are inlined during evaluation, meaning their logic replaces the call site to optimize performance. This ensures fast decisions without extra network calls.

Why designed this way?

Firebase rules were designed to be simple, fast, and secure. Allowing custom functions lets developers avoid repeating code, reducing errors. However, to keep rules fast and safe, functions are limited: no loops, no external calls, and no side effects. This design balances flexibility with performance and security.

┌───────────────────────────────┐
│ Client Request (read/write)   │
└───────────────┬───────────────┘
                │
                ▼
┌───────────────────────────────┐
│ Firebase Rules Engine          │
│ ┌───────────────────────────┐ │
│ │ Parse Rules & Functions   │ │
│ │ Inline function calls     │ │
│ │ Evaluate conditions       │ │
│ └───────────────────────────┘ │
│           │                   │
│           ▼                   │
│ Allow or Deny Access          │
└───────────────┬───────────────┘
                │
                ▼
       Data Access Allowed/Denied

Myth Busters - 4 Common Misconceptions

Quick: Do you think custom functions in Firebase rules can perform loops or recursion? Commit to yes or no.

Common Belief: Custom functions can have loops or call themselves recursively to handle complex logic.

Reality: Firebase rules functions do not support loops or recursion. They must be simple and side-effect free.

Why it matters: Trying to use loops or recursion causes rule errors or unexpected behavior, blocking deployment or causing security gaps.

Quick: Do you think custom functions can access external APIs or databases? Commit to yes or no.

Common Belief: Functions in rules can call external services to check permissions dynamically.

Reality: Functions run only inside Firebase rules and cannot call external APIs or databases.

Why it matters: Expecting dynamic external checks leads to insecure rules or failed requests because rules cannot fetch outside data.

Quick: Do you think defining the same logic in multiple places is better than using functions? Commit to yes or no.

Common Belief: Writing repeated conditions directly in each rule is clearer than using functions.

Reality: Repeating logic increases errors and maintenance effort; functions improve clarity and reduce mistakes.

Why it matters: Without functions, updating access logic requires multiple edits, risking inconsistent security.

Quick: Do you think functions can modify data or state in Firebase? Commit to yes or no.

Common Belief: Functions in rules can change data or user state during evaluation.

Reality: Functions are pure checks and cannot modify data or state; they only return true or false.

Why it matters: Misunderstanding this can lead to expecting side effects that never happen, causing logic errors.

Expert Zone

1

Functions are evaluated every time a rule runs, so keeping them efficient avoids slowing down data access.

2

Functions can call other functions, but deep nesting can make debugging rules difficult and obscure error messages.

3

Using functions to centralize role checks or ownership logic prevents subtle security bugs in large, complex apps.

When NOT to use

Avoid using custom functions when your logic requires loops, recursion, or external data fetching. Instead, handle complex logic in your app backend or Cloud Functions and keep rules simple for fast evaluation.

Production Patterns

In production, developers use functions to enforce consistent ownership checks, role-based access, and data validation. They often organize functions at the top of the rules file for clarity and reuse. Functions also help when multiple collections share similar access patterns.

Connections

Functions in Programming Languages

Custom functions in Firebase rules are a simplified form of functions in programming languages.

Understanding how functions encapsulate reusable logic in programming helps grasp why Firebase rules use functions to avoid repetition and improve clarity.

Access Control Lists (ACLs)

Custom functions help implement ACL-like checks inside Firebase rules.

Knowing ACLs from traditional security models clarifies how functions centralize permission checks for users and roles.

Mathematical Logic

Functions in rules express logical conditions that must be true for access.

Recognizing that rules are logical expressions helps understand how functions combine conditions with AND, OR, and NOT to enforce security.

Common Pitfalls

#1 Repeating the same condition in multiple rules without using functions.

Wrong approach:

allow read: if request.auth.uid == resource.data.ownerId;
allow write: if request.auth.uid == resource.data.ownerId;

Correct approach:

function isOwner() {
return request.auth.uid == resource.data.ownerId;
}
allow read: if isOwner();
allow write: if isOwner();

Root cause:

Not knowing functions can reuse logic leads to duplicated code and harder maintenance.

#2 Trying to use loops inside a custom function to check multiple conditions.

Wrong approach:

function checkAll() {
for (let i = 0; i < 5; i++) {
if (someCondition(i)) return false;
}
return true;
}

Correct approach:

function checkCondition1() { return ...; }
function checkCondition2() { return ...; }
function checkAll() {
return checkCondition1() && checkCondition2();
}

Root cause:

Misunderstanding that Firebase rules do not support loops or iteration.

#3 Expecting functions to modify data or perform side effects.

Wrong approach:

function updateFlag() {
resource.data.flag = true;
return true;
}

Correct approach:

function isFlagSet() {
return resource.data.flag == true;
}

Root cause:

Confusing rules functions with programming functions that can change state.

Key Takeaways

Custom functions in Firebase rules let you write reusable, clear checks to control data access.

They help avoid repeating the same logic, making rules easier to read and maintain.

Functions cannot have loops, recursion, or side effects; they only return true or false based on conditions.

Using functions to centralize security checks reduces bugs and keeps your app safe as it grows.

Understanding function limits and best practices ensures your rules stay fast, secure, and manageable.

Practice

1. What is the main benefit of using custom functions in Firebase security rules?

easy

A. They make rules easier to read and reuse common checks

B. They automatically fix security vulnerabilities

C. They increase the speed of database queries

D. They replace the need for authentication

Solution

1. Step 1: Understand the purpose of custom functions

   Custom functions in Firebase rules are designed to simplify and organize security logic by reusing common checks.

2. Step 2: Compare options to the purpose

   Only They make rules easier to read and reuse common checks correctly states that custom functions make rules easier to read and reuse common checks. Other options describe unrelated or incorrect benefits.

3. Final Answer:

   They make rules easier to read and reuse common checks -> Option A

4. Quick Check:

   Custom functions improve readability and reuse = A [OK]

Hint: Custom functions simplify and reuse checks in rules [OK]

Common Mistakes:

• Thinking custom functions speed up queries
• Believing they fix security automatically
• Confusing them with authentication features

2. Which of the following is the correct syntax to define a custom function named isOwner in Firebase rules?

easy

A. function isOwner() = request.auth.uid == resource.data.owner;

B. isOwner() => request.auth.uid == resource.data.owner;

C. function isOwner() { return request.auth.uid == resource.data.owner; }

D. isOwner() { return request.auth.uid == resource.data.owner; }

Solution

1. Step 1: Recall Firebase rules function syntax

   Firebase rules use the syntax: function name() { return expression; } to define custom functions.

2. Step 2: Identify the correct syntax

   function isOwner() { return request.auth.uid == resource.data.owner; } matches the correct syntax. isOwner() { return request.auth.uid == resource.data.owner; } omits the required function keyword. Options B and C use invalid syntax.

3. Final Answer:

   function isOwner() { return request.auth.uid == resource.data.owner; } -> Option C

4. Quick Check:

   Firebase custom function syntax uses function name() { return ... } = A [OK]

Hint: Firebase rules functions use function name() { return ... } syntax [OK]

Common Mistakes:

• Omitting the 'function' keyword
• Using arrow functions which are not supported
• Using '=' instead of function body block

3. Given the following Firebase rule snippet:

function isAdmin() { return request.auth.token.admin == true; }
allow write: if isAdmin();

What happens if request.auth.token.admin is false?

medium

A. Write access is denied

B. Write access is granted

C. Rule throws a syntax error

D. Write access is granted only if user is authenticated

Solution

1. Step 1: Understand the function logic

   The function isAdmin() returns true only if request.auth.token.admin is true.

2. Step 2: Evaluate the rule condition

   The write permission is allowed only if isAdmin() returns true. If request.auth.token.admin is false, the function returns false, so write is denied.

3. Final Answer:

   Write access is denied -> Option A

4. Quick Check:

   isAdmin false means no write access = A [OK]

Hint: Function returns false blocks access; true allows it [OK]

Common Mistakes:

• Assuming false admin still grants access
• Thinking rule throws error on false
• Confusing authentication with admin check

4. Identify the error in this Firebase rule custom function:

function isOwner() {
  request.auth.uid == resource.data.owner;
}
allow read: if isOwner();

medium

A. Incorrect function name syntax

B. Invalid comparison operator

C. Using 'allow' outside match block

D. Missing return statement inside the function

Solution

1. Step 1: Check function body for return

   The function compares values but does not return the result, so it returns null by default.

2. Step 2: Understand impact on rule

   Without a return, isOwner() returns null (falsey), so the rule will deny access unexpectedly.

3. Final Answer:

   Missing return statement inside the function -> Option D

4. Quick Check:

   Functions must return values explicitly = B [OK]

Hint: Always return a value in custom functions [OK]

Common Mistakes:

• Forgetting to add 'return' before expression
• Assuming last line auto-returns value
• Misplacing 'allow' statements

5. You want to create a reusable custom function canEdit() that allows editing if the user is either the owner or has an admin role. Which of the following is the correct way to write this function in Firebase rules?

hard

A. canEdit() { if (request.auth.uid == resource.data.owner) return true; else return false; }

B. function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; }

C. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; }

D. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin; }

Solution

1. Step 1: Understand the logic needed

   The function should return true if the user is owner OR has admin role.

2. Step 2: Analyze each option

   function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } correctly uses function keyword, logical OR (||) and explicit admin comparison. canEdit() { if (request.auth.uid == resource.data.owner) return true; else return false; } only checks owner. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } and canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin; } omit required function keyword.

3. Final Answer:

   function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } -> Option B

4. Quick Check:

   function keyword + OR + admin == true = B [OK]

Hint: Use function keyword, || and explicit admin == true check [OK]

Common Mistakes:

• Using AND instead of OR for conditions
• Not explicitly comparing admin to true
• Ignoring admin role in logic