How to Set Max File Size in Firebase Storage

You set the max file size in Firebase Storage by writing security rules that check the request.resource.size property during upload. Additionally, you can enforce file size limits on the client side before uploading to prevent large files from being sent.

Syntax

Firebase Storage security rules use the request.resource.size property to check the size of the file being uploaded. You write a rule inside allow write that returns true only if the file size is less than or equal to your limit.

Example parts:

• request.resource.size: size of the file being uploaded in bytes
• maxSize: your max allowed size in bytes
• allow write: if request.resource.size <= maxSize;: rule to allow upload only if size is within limit

firebase

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow write: if request.resource.size <= maxSize;
    }
  }
}

Example

This example sets a max file size of 5 megabytes (5 * 1024 * 1024 bytes) for all uploads to Firebase Storage. Files larger than this will be rejected by the security rules.

firebase

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow write: if request.resource.size <= 5 * 1024 * 1024;
      allow read: if true;
    }
  }
}

Output

Uploads larger than 5 MB are denied with a permission error; smaller files upload successfully.

Common Pitfalls

1. Forgetting to check request.resource.size in rules: Without this check, any file size is allowed.

2. Using resource.size instead of request.resource.size: resource.size refers to the existing file size, not the upload size.

3. Not enforcing client-side checks: Relying only on rules causes failed uploads after sending large files, wasting bandwidth.

4. Incorrect units: Remember file size is in bytes, so convert MB or KB properly.

firebase

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      // Wrong: uses resource.size (existing file size)
      allow write: if resource.size <= 5 * 1024 * 1024;
      
      // Correct: uses request.resource.size (upload size)
      allow write: if request.resource.size <= 5 * 1024 * 1024;
    }
  }
}

Quick Reference

• Use request.resource.size in security rules to check upload size.
• File size is in bytes; 1 MB = 1024 * 1024 bytes.
• Combine server-side rules with client-side checks for best user experience.
• Test rules with Firebase Emulator before deploying.

Key Takeaways

Set max file size in Firebase Storage rules using request.resource.size property.

Always convert your max size limit to bytes for accurate checks.

Combine security rules with client-side file size validation to save bandwidth.

Use Firebase Emulator to test your storage rules before production.

Avoid using resource.size which refers to existing files, not uploads.