Storage security rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

Identify the effect of this Firebase Storage rule

Given the following Firebase Storage security rule, what is the effect on file uploads?

service firebase.storage {
  match /b/{bucket}/o {
    match /user_uploads/{userId}/{allPaths=**} {
      allow write: if request.auth != null && request.auth.uid == userId;
      allow read: if false;
    }
  }
}

A Only authenticated users can read files; anyone can upload files.

B Anyone can upload files to any folder; only authenticated users can read files.

C Only authenticated users can upload files to their own folder; no one can read any files.

D No one can upload or read any files.

💡 Hint

Look at the conditions for write and read separately.

The rule allows write only if the user is authenticated and their UID matches the folder name, so users can upload only to their own folder. The read is explicitly denied for everyone.

❓ service_behavior

intermediate

What happens when a user tries to read a file with this rule?

Consider this Firebase Storage rule:

service firebase.storage {
  match /b/{bucket}/o {
    match /public/{allPaths=**} {
      allow read: if true;
      allow write: if false;
    }
  }
}

What happens when any user tries to read a file in the 'public' folder?

A Only users with admin role can read files.

B The read request is allowed for all users.

C Only authenticated users can read files.

D The read request is denied for all users.

💡 Hint

Check the condition for read permission.

The rule explicitly allows read for everyone by using 'if true'.

❓ Architecture

advanced

Choose the best rule to restrict file deletion to owners only

You want to allow users to upload and delete only their own files under 'users/{userId}/files/'. Which Firebase Storage rule achieves this?

A allow write: if request.auth != null && request.auth.uid == userId && (resource == null || request.resource == null);

B allow write: if request.auth != null && request.auth.uid == userId && request.method == 'delete';

C allow write: if request.auth != null && request.auth.uid == userId;

D allow write: if request.auth != null && request.auth.uid == userId && request.resource == null;

💡 Hint

Consider how to allow both upload and delete but restrict others.

Option A allows write only if the user owns the folder and it's either a create (resource == null) or delete (request.resource == null), covering upload and deletion but not updates.

🧠 Conceptual

advanced

What error occurs if a rule references an undefined variable?

In Firebase Storage rules, what happens if you write a rule that uses a variable not defined in the path or request context, like 'userId' without declaring it in the path?

A The rule causes a compilation error and deployment fails.

B The rule deploys but always denies access at runtime.

C The rule ignores the undefined variable and allows access.

D The rule causes a runtime error when accessed.

💡 Hint

Think about how Firebase validates rules before deployment.

Firebase validates rules on deployment and will reject rules with undefined variables, causing deployment to fail.

✅ Best Practice

expert

Select the best practice for securing user files in Firebase Storage

Which of the following is the best practice to secure user files in Firebase Storage to prevent unauthorized access?

A Allow read and write access to all authenticated users for all files.

B Allow public read access and restrict write access to admins only.

C Disable all security rules and rely on client-side checks.

D Use folder paths with user IDs and restrict access so users can only read and write their own folders.

💡 Hint

Think about isolating user data and limiting access.

Best practice is to isolate user data by folder and restrict access so users can only access their own files, preventing unauthorized access.

Practice

1. What is the main purpose of Firebase Storage security rules?

easy

A. To control who can read or write files in storage

B. To speed up file uploads

C. To increase storage space automatically

D. To backup files to another server

Solution

1. Step 1: Understand the role of security rules

   Security rules define who can access files and what actions they can perform.

2. Step 2: Identify the main function

   The main function is to control read and write permissions to protect data.

3. Final Answer:

   To control who can read or write files in storage -> Option A

4. Quick Check:

   Security rules = control access [OK]

Hint: Security rules control access permissions only [OK]

Common Mistakes:

• Thinking rules speed up uploads
• Believing rules increase storage size
• Confusing rules with backup features

2. Which of the following is the correct syntax to allow only authenticated users to read files in Firebase Storage rules?

easy

A. allow read: if request.auth != null;

B. allow read: if user.authenticated == true;

C. allow read: if auth.user != null;

D. allow read: if request.user.authenticated;

Solution

1. Step 1: Check Firebase Storage rules syntax

   The correct way to check authentication is using request.auth != null.

2. Step 2: Compare options

   Only allow read: if request.auth != null; uses the correct Firebase syntax for authentication check.

3. Final Answer:

   allow read: if request.auth != null; -> Option A

4. Quick Check:

   Authentication check = request.auth != null [OK]

Hint: Use request.auth to check user authentication [OK]

Common Mistakes:

• Using incorrect variable names like user.authenticated
• Missing the 'request.' prefix
• Using wrong boolean checks

3. Given the following Firebase Storage rule snippet, what happens when an unauthenticated user tries to read a file?

service firebase.storage {
  match /b/{bucket}/o {
    match /files/{fileId} {
      allow read: if request.auth != null;
      allow write: if false;
    }
  }
}

medium

A. The read request causes a syntax error

B. The read request is allowed because write is false

C. The read request is allowed because no write permission is needed

D. The read request is denied because the user is not authenticated

Solution

1. Step 1: Analyze the read rule condition

   The rule allows read only if request.auth != null, meaning user must be authenticated.

2. Step 2: Consider unauthenticated user

   An unauthenticated user has request.auth == null, so the condition fails and read is denied.

3. Final Answer:

   The read request is denied because the user is not authenticated -> Option D

4. Quick Check:

   Unauthenticated read = denied [OK]

Hint: Read allowed only if request.auth is not null [OK]

Common Mistakes:

• Ignoring the read condition and assuming access
• Confusing read and write permissions
• Thinking false write affects read

4. Identify the error in this Firebase Storage rule that aims to allow users to write only to their own folder:

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow write: if request.auth.uid == userId;
    }
  }
}

medium

A. The variable userId is not defined in the path

B. The wildcard {allPaths=**} is incorrectly used

C. The rule does not allow read access

D. The condition should use request.auth.userId instead of request.auth.uid

Solution

1. Step 1: Check path variables

   The path correctly defines {userId} and {allPaths=**} wildcards.

2. Step 2: Review condition and permissions

   The condition correctly compares request.auth.uid with userId for write permission.

3. Step 3: Identify missing read permission

   The rule only allows write, no read permission is granted, which may block legitimate reads.

4. Final Answer:

   The rule does not allow read access -> Option C

5. Quick Check:

   Missing read permission = problem [OK]

Hint: Check if both read and write permissions are set [OK]

Common Mistakes:

• Assuming write permission covers read
• Confusing request.auth.uid with userId variable
• Misusing wildcard syntax

5. You want to allow users to upload images only to their own folder and only if the file size is less than 2MB. Which Firebase Storage rule correctly enforces this?

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{fileName} {
      allow write: if request.auth.uid == userId && request.resource.size < 2 * 1024 * 1024;
      allow read: if request.auth.uid == userId;
    }
  }
}

hard

A. The file size check should use resource.size instead of request.resource.size

B. This rule correctly enforces user ownership and file size limit

C. The rule should allow write without checking user ID

D. The size limit should be checked on the existing file, not request.resource

Solution

1. Step 1: Verify user ownership condition

   The rule checks request.auth.uid == userId to ensure users write only to their folder.

2. Step 2: Verify file size condition

   The rule uses request.resource.size < 2 * 1024 * 1024 to limit uploads to less than 2MB.

3. Step 3: Confirm read permission

   Read is allowed only for the authenticated user matching userId.

4. Final Answer:

   This rule correctly enforces user ownership and file size limit -> Option B

5. Quick Check:

   User ID and size check = correct [OK]

Hint: Use request.resource.size for new file size check [OK]

Common Mistakes:

• Using resource.size instead of request.resource.size
• Not checking user ID for write
• Checking size on existing file instead of upload