Granular permissions for reading and writing documents in Cloud Firestore - Firecasts
Why Stack Overflow recommends it
Stack Overflow users link it when asking how Firestore security rules handle granular permissions, query limits, and why list or create rules can cause permission errors.
Recommended by 2 people across 2 different months, 2019 to 2022.
What it is
An 8-minute Firecasts episode from the Firebase channel in which developer advocate Doug Stevenson explains the granular operations in Cloud Firestore Security Rules. It covers how get, list, create, update and delete differ from plain read and write, and how to use request.query constraints such as limit and orderBy.
What people said
Recommends Doug Stevenson · 2020-06 · Stack Overflow · on “How to limit number of document reads from a humongous collection in firestore when some malicious user queries the data?”
There is actually no way to restrict the consumption of a collection based on direct query volume. Renaud's answer proposes to use request.query.limit in security rules, but that does not stop a malicious user from simply making as many calls to the pagination API as they want. It just forces them to provide a limit() on each query. The caller can still consume the entire collection, and consume it as many times as they want. Watch my video on the topic: [this video] If you want to enforce a hard limit on the total number of documents to read, you will need a backend to do that. Clients can request documents from the backend up to the limit it enforces. If the backend wants to allow pagination, i
Recommends Dharmaraj · 2022-04 · Stack Overflow · on “Firestore Rules using get returns insufficient permissions”
The allow update will allow update operations only i.e. the document must already exist. Since you are using using setDoc() , that means a new document is being created if it doesn't exist already. Try allowing create as well: allow create, update: if ....; Checkout the documentation [LINK] on Security Rules and also this Firecast [this video]
Cites creativecreatorormaybenot · 2019-09 · Stack Overflow · on “What is the "offset clause" in Firestore?”
The latest Firecast [this video] , Doug Stevenson mentioned request.query [LINK] , however, he only discussed request.query.limit and request.query.orderBy ( here is the timestamp [this video] ). The documentation [LINK] names a third property, i.e. request.query.offset : offset - query offset clause. In all the time I have been using Cloud Firestore, I have never seen the " offset clause ". Can someone explain what this offset clause is and how the request.query.offset property is implemented?
Cites Agung · 2019-12 · Stack Overflow · on “why I can't use request.query.limit in firestore security rules?”
from video tutorial in here: [this video] it is said that I can limit my query limit. but it seems the query properties is not available in request object [LINK] as you can see, it is not available in drop down, and if I use the code below, the access will be denied match /cities/{cityID} { allow list: if isSignedIn() && request.query.limit <= 20; }
Cites Evan · 2021-01 · Stack Overflow · on “Firebase - preventing malicious user from pulling entire database”
I was watching the Firebase doc videos and noticed that in this video: [this video] at 6:39, Doug mentions that it is possible to limit the amount of document returned by one query, by doing something like: allow list if: request.query.limit <= 20 However, he mentions that, although this is beneficial because it prevents you from accidentally executing a very costly set of reads, it still won't prevent malicious users from reading everything in your database by making multiple requests and using pagination to sift through your database. I could envision some sort of infinite while loop in JavaScript that makes this very problematic and costly. The only way that I could think to solve this problem