Storage security rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

Identify the effect of this Firebase Storage rule

Given the following Firebase Storage security rule, what is the effect on file uploads?

service firebase.storage {
  match /b/{bucket}/o {
    match /user_uploads/{userId}/{allPaths=**} {
      allow write: if request.auth != null && request.auth.uid == userId;
      allow read: if false;
    }
  }
}

A Only authenticated users can read files; anyone can upload files.

B Anyone can upload files to any folder; only authenticated users can read files.

C Only authenticated users can upload files to their own folder; no one can read any files.

D No one can upload or read any files.

💡 Hint

Look at the conditions for write and read separately.

The rule allows write only if the user is authenticated and their UID matches the folder name, so users can upload only to their own folder. The read is explicitly denied for everyone.

❓ service_behavior

intermediate

What happens when a user tries to read a file with this rule?

Consider this Firebase Storage rule:

service firebase.storage {
  match /b/{bucket}/o {
    match /public/{allPaths=**} {
      allow read: if true;
      allow write: if false;
    }
  }
}

What happens when any user tries to read a file in the 'public' folder?

A Only users with admin role can read files.

B The read request is allowed for all users.

C Only authenticated users can read files.

D The read request is denied for all users.

💡 Hint

Check the condition for read permission.

The rule explicitly allows read for everyone by using 'if true'.

❓ Architecture

advanced

Choose the best rule to restrict file deletion to owners only

You want to allow users to upload and delete only their own files under 'users/{userId}/files/'. Which Firebase Storage rule achieves this?

A allow write: if request.auth != null && request.auth.uid == userId && (resource == null || request.resource == null);

B allow write: if request.auth != null && request.auth.uid == userId && request.method == 'delete';

C allow write: if request.auth != null && request.auth.uid == userId;

D allow write: if request.auth != null && request.auth.uid == userId && request.resource == null;

💡 Hint

Consider how to allow both upload and delete but restrict others.

Option A allows write only if the user owns the folder and it's either a create (resource == null) or delete (request.resource == null), covering upload and deletion but not updates.

🧠 Conceptual

advanced

What error occurs if a rule references an undefined variable?

In Firebase Storage rules, what happens if you write a rule that uses a variable not defined in the path or request context, like 'userId' without declaring it in the path?

A The rule causes a compilation error and deployment fails.

B The rule deploys but always denies access at runtime.

C The rule ignores the undefined variable and allows access.

D The rule causes a runtime error when accessed.

💡 Hint

Think about how Firebase validates rules before deployment.

Firebase validates rules on deployment and will reject rules with undefined variables, causing deployment to fail.

✅ Best Practice

expert

Select the best practice for securing user files in Firebase Storage

Which of the following is the best practice to secure user files in Firebase Storage to prevent unauthorized access?

A Allow read and write access to all authenticated users for all files.

B Allow public read access and restrict write access to admins only.

C Disable all security rules and rely on client-side checks.

D Use folder paths with user IDs and restrict access so users can only read and write their own folders.

💡 Hint

Think about isolating user data and limiting access.

Best practice is to isolate user data by folder and restrict access so users can only access their own files, preventing unauthorized access.