Day 10: The allow read, write: if true; Disaster

I still see devs (even pros) leaving this in their Firestore rules during testing:

// ❌ PLEASE DON'T

service cloud.firestore {

match /databases/{database}/documents {

match /{document=**} {

allow read, write: if true;

}

}

}

It works. It’s fast.

It also means anyone on the internet can read, write, delete, or overwrite anything in your database — no auth needed.

✅ Better: Restrict by request.auth != null and, if possible, user-specific ownership.

service cloud.firestore {

match /databases/{database}/documents {

match /users/{userId} {

allow read, write: if request.auth != null && request.auth.uid == userId;

}

}

}

This way:

Only logged-in users can access data

They can only touch their own documents

🧠 Takeaway:

> “Your Firebase rules are your database’s last line of defense — treat them like production code.”

If this saved your data from getting roasted, maybe buy me a coffee to keep the security tips flowing:

👉 buymeacoffee.com/ejjat ☕

#firebase #firestore #securitytips #dailydev #buymeacoffee