Read and write permissions in Firebase - Commands & Configuration

Introduction

Firebase security rules control who can read or write data in your database. They protect your data from unauthorized access and changes.

When you want only logged-in users to read their own data.

When you want to prevent anyone from deleting data accidentally.

When you want to allow public read but restrict write access to admins.

When you want to test your app with open access during development.

When you want to secure sensitive information from being read by others.

Config File - firestore.rules

firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow read/write only if user is authenticated
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    // Allow read to everyone, write only to admins
    match /publicData/{docId} {
      allow read: if true;
      allow write: if request.auth != null && request.auth.token.admin == true;
    }
  }
}

This file sets rules for Firestore database access.

The users/{userId} path allows only the user with matching ID to read and write their data.

The publicData/{docId} path allows anyone to read but only authenticated admins to write.

Commands

This command uploads and activates the security rules to your Firebase project to enforce read and write permissions.

Terminal

firebase deploy --only firestore:rules

Expected Output

=== Deploying to 'your-project-id'...



✔  firestore: rules: firestore.rules



✔  Deploy complete!



Project Console: https://console.firebase.google.com/project/your-project-id/overview

→

--only firestore:rules - Deploy only Firestore security rules without affecting other services

Starts the local Firestore emulator to test your security rules without affecting live data.

Terminal

firebase emulators:start --only firestore

Expected Output

i  emulators: Starting emulators: firestore

✔  firestore emulator running at http://localhost:8080



⚠  firestore: The rules file firestore.rules was loaded successfully

→

--only firestore - Run only the Firestore emulator

Runs tests against your Firestore security rules using a test file to verify read and write permissions.

Terminal

firebase firestore:rules:test --rules=firestore.rules --file=rules_test.json

Expected Output

PASS 3 tests, FAIL 0 tests

All security rules tests passed successfully.

Key Concept

If you remember nothing else from this pattern, remember: security rules must explicitly allow read or write access based on user identity or roles to protect your data.

Common Mistakes

Allowing read or write access without checking if the user is authenticated.

This lets anyone read or change your data, risking data leaks or corruption.

Always check if request.auth is not null before allowing access.

Using overly broad rules like 'allow read, write: if true;' in production.

This removes all protection and exposes your database to the public.

Use specific conditions that limit access to authorized users only.

Not testing rules locally before deploying.

Mistakes in rules can cause your app to break or expose data unintentionally.

Use the Firebase emulator and rules test commands to verify rules before deployment.

Summary

Write security rules in firestore.rules to control who can read and write data.

Deploy rules using 'firebase deploy --only firestore:rules' to activate them.

Test rules locally with Firebase emulators and rule test commands before deploying.

Practice

1. What is the main purpose of Firebase read and write permissions?

easy

A. To control who can view or change data in the database

B. To speed up data retrieval from the database

C. To backup data automatically

D. To create new database tables

Solution

1. Step 1: Understand permission roles

   Read and write permissions define who can access or modify data.

2. Step 2: Identify the purpose

   They protect data by controlling access, not by speeding up or backing up data.

3. Final Answer:

   To control who can view or change data in the database -> Option A

4. Quick Check:

   Permissions control access = A [OK]

Hint: Permissions control access, not speed or backups [OK]

Common Mistakes:

• Confusing permissions with performance features
• Thinking permissions create database structure
• Assuming permissions handle backups

2. Which Firebase rule syntax correctly allows only authenticated users to read data?

easy

A. "read": "true"

B. "read": "auth != null"

C. "read": "auth == null"

D. "read": "false"

Solution

1. Step 1: Understand auth variable

   In Firebase rules, auth != null means user is logged in.

2. Step 2: Match condition to requirement

   Allowing read only if auth != null means only authenticated users can read.

3. Final Answer:

   "read": "auth != null" -> Option B

4. Quick Check:

   auth != null means logged in = C [OK]

Hint: auth != null means user is logged in [OK]

Common Mistakes:

• Using auth == null which allows unauthenticated users
• Setting read to true allows everyone
• Setting read to false blocks all reads

3. Given this Firebase rule snippet:

{
  "rules": {
    "messages": {
      ".read": "auth != null",
      ".write": "auth.uid == data.child('owner').val()"
    }
  }
}

What happens if a logged-in user tries to write a message where they are not the owner?

medium

A. Write is denied because user is not the owner

B. Write is allowed because user is logged in

C. Write is allowed for all users

D. Write causes a syntax error

Solution

1. Step 1: Analyze write condition

   Write is allowed only if auth.uid equals the owner field in data.

2. Step 2: Check user ownership

   If user is not owner, condition fails, so write is denied.

3. Final Answer:

   Write is denied because user is not the owner -> Option A

4. Quick Check:

   Write allowed only if user owns data = D [OK]

Hint: Write allowed only if auth.uid matches owner [OK]

Common Mistakes:

• Assuming logged-in users can write anywhere
• Confusing read and write rules
• Ignoring the owner check in write condition

4. Identify the error in this Firebase rule snippet:

{
  "rules": {
    "posts": {
      ".read": "auth != null",
      ".write": "auth.uid = data.child('author').val()"
    }
  }
}

medium

A. data.child() cannot be used in rules

B. Missing quotes around auth.uid

C. auth != null is invalid syntax

D. Using single equals (=) instead of double equals (==) in write condition

Solution

1. Step 1: Check write condition syntax

   Single equals (=) is assignment, not comparison in Firebase rules.

2. Step 2: Correct comparison operator

   Use double equals (==) to compare auth.uid and data.child('author').val().

3. Final Answer:

   Using single equals (=) instead of double equals (==) in write condition -> Option D

4. Quick Check:

   Use == for comparison, not = [OK]

Hint: Use == for comparison, not = [OK]

Common Mistakes:

• Confusing assignment (=) with comparison (==)
• Thinking auth.uid needs quotes
• Believing data.child() is invalid in rules

5. You want to allow users to read all their own profile data but prevent others from reading it. Which Firebase rule correctly enforces this?

{
  "rules": {
    "profiles": {
      "$userId": {
        ".read": "?",
        ".write": "auth.uid == $userId"
      }
    }
  }
}

hard

A. "auth != null"

B. "true"

C. "auth.uid == $userId"

D. "auth.uid != $userId"

Solution

1. Step 1: Understand read condition need

   Users should read only their own profile, so read must check auth.uid equals $userId.

2. Step 2: Match read condition to requirement

   Setting ".read": "auth.uid == $userId" restricts read access to owner only.

3. Final Answer:

   "auth.uid == $userId" -> Option C

4. Quick Check:

   Read allowed only if user matches profile ID = B [OK]

Hint: Read only if auth.uid equals profile ID [OK]

Common Mistakes:

• Using auth != null allows all logged-in users to read
• Setting read to true allows everyone
• Using auth.uid != $userId allows others to read