I still see devs (even pros) leaving this in their Firestore rules during testing:
// โ PLEASE DON'T
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}
It works. Itโs fast.
It also means anyone on the internet can read, write, delete, or overwrite anything in your database โ no auth needed.
โ Better: Restrict by request.auth != null and, if possible, user-specific ownership.
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth != null && request.auth.uid == userId;
}
}
}
This way:
Only logged-in users can access data
They can only touch their own documents
๐ง Takeaway:
> โYour Firebase rules are your databaseโs last line of defense โ treat them like production code.โ
If this saved your data from getting roasted, maybe buy me a coffee to keep the security tips flowing:
๐ buymeacoffee.com/ejjat โ
#firebase #firestore #securitytips #dailydev #buymeacoffee