Storage security rules in Firebase - Step-by-Step Execution

Process Flow - Storage security rules

User sends request

↓

Check authentication?

No→Deny access

Yes↓

Check rules conditions

↓

Allow access

When a user tries to access storage, Firebase checks if they are signed in, then evaluates security rules to allow or deny access.

Execution Sample

Firebase

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read: if request.auth != null;
      allow write: if false;
    }
  }
}

This rule allows only authenticated users to read files and denies all write requests.

Process Table

Step	Request Type	User Authenticated?	Rule Condition	Access Decision
1	Read	Yes	request.auth != null	Allow
2	Write	Yes	false	Deny
3	Read	No	request.auth != null	Deny
4	Write	No	false	Deny

💡 Access is denied if user is not authenticated or rule condition is false.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
request.auth	null	object (user info)	object (user info)	null	null
rule condition	N/A	true	false	false	false
access decision	N/A	Allow	Deny	Deny	Deny

Key Moments - 2 Insights

Why does a read request from an unauthenticated user get denied?

Because the rule requires request.auth != null to allow read, and unauthenticated users have request.auth as null (see execution_table row 3).

Why are all write requests denied even if the user is authenticated?

The write rule condition is false, so no write is allowed regardless of authentication (see execution_table rows 2 and 4).

Visual Quiz - 3 Questions

Look at the execution table, what is the access decision for a read request by an authenticated user?

A Deny

B Allow

C Depends on file path

D Error

💡 Hint

Check execution_table row 1 under 'Access Decision'

At which step does the condition 'request.auth != null' evaluate to false?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at execution_table rows where User Authenticated? is No

If the write rule changed to 'allow write: if request.auth != null;', what would happen at step 2?

A Error in rules

B Access would still be denied

C Access would be allowed

D Access depends on file path

💡 Hint

Compare current write rule condition false with new condition true for authenticated user

Concept Snapshot

Firebase Storage Security Rules:
- Check if user is authenticated (request.auth != null)
- Allow or deny read/write based on conditions
- Deny access if conditions fail
- Rules apply to file paths
- Always test rules with different user states

Full Transcript

Firebase Storage security rules control who can read or write files. When a user sends a request, Firebase first checks if the user is signed in. If not signed in, access is denied. If signed in, Firebase checks the rule conditions. For example, a rule may allow reads only if the user is authenticated and deny all writes. Each request is evaluated step-by-step to decide if access is allowed or denied. This ensures storage is secure and only authorized users can access files.