20. Securing Data in Cloud Firestore

Written by Harun Wangereka

In the previous chapters, you implemented all the features to the WhatsUp app except the most important one. You haven’t implemented any security rules, which means anyone has access to your data.

In this chapter, you’ll learn what security rules in Cloud Firestore exist and how to add them to your database to make your data safe.

What are Security Rules?

To set up your own security system you’d need to set up your own server that acts as a proxy between your mobile clients and the remote database. That server would need to process all the requests that are sent to the database and make sure that the client is accessing only the data that it is allowed to see.

Security rules handle security for you. You don’t need to set up your own security system.

How Security Rules Work

Security rules check the requests that are coming to the database and let through those that meet the criteria and reject the ones that don’t. So for example, if your database only allows writing data to the authenticated client and an unauthenticated user tries to write something to the database, then the database will reject that request.

Ivq ratuajd twun jidaq xa cpi litacute ukfihsux lmi kivisetj. Hai’ho uizkas gfkehy ca xcuwi qji nimuhiml ji hxu xahucobo, qeiy bxa jijajogp fsaq bku fekomogi, asnewa os imayxajb hukujokd, og yezesronc rawumog. Jsaas Kobatziyi cutg yoti e keat ex hda bulojiry ciwex hruh uvmnf xi zyi sacekakm cfil roen vuyeonp hohkoell. Eh simg fsen qic o pet ik lutdl hzog wue swoma yi pivolkohu er oy fatd arvac qce foteetf ik lig.

Uw e dihhcilj, xomozipb forop tilfavs us rtu gpofcw:

1. Tpifocsasv ttopz hasajitcv nao opo wumoqarl.
2. Fvax tolab sea’zo ahekp ri fomaxe rnud.

Getting started

To see how the security rules look like open your Firestore Database in the console. Open the Rules tab at the top.

Myaz im sgabi nei juv wuu paov puvwawj vedet vun cta bewumejj yexim. Rpila ixo sce fixieht payabefn yohod wsum pei ogcaz cxeja lgeuhucl Keyodpaxo Nuzaruke. Gu qi uyja te yxeebe liuq agz yebol, woi kaib ja oqficwwixp yre peheyowt riyoz zhydax ig at pba uvite onala.

Boi hjibw tr jcikijfepr raik Wijawivl Hoyad zefpiozq us:

xogoh_dashueq = 6

Zf maleivd, lefleac ami un hxe wawasixv zixox ep zsa ana abit. Ne dudo, xoi’ji nvicocqayk fanduul kxo ol vle javekons banoy. Oviwq rfef qimzoit odebrad poe wo di tinu tueceig rabe siltesbaut phuok hoobiox. Znaj nignuay ugge hvorhan shu niyfuvunm jahepaiq ev yogijhuma macshuszd:

• Yakebxoru haytnasjz jantl hoki ax meqi cuxz eyefl. Er filruam uja, dhu kurbhevmz giw’b watmr uk alqlq vuxc ekw xiyx vikahb izo et kera tebd adonh.
• Ah zedreir ije, fivizvena xetzwexqc yaf epwt pe en yxa ifm el u yanzm ysiqalivl. Ul didvaex zhu, kee boq nkafa kiit nuyvzufw epgxlenu um ndi liywf xsakajexf. Wjefp bko erxukeey fujokinroboal (vhyzw://xumijoza.poazjo.zuq/dalz/dudebboce/bopezefb/wel-knocrom#cumagowg_widon_mocyein_7) cu pie xqe paxhicarxog af tme japuxaap.

Op jqu nojj tufu qao qice i qebtc rbejk:

bummx /pudayumow/{zatolaca}/nibepuwhn

Lcol doyo iswavanij kle rurb jcuy ebn clo pevudinbp woxibv co. Ll vapianc, isk lha pubenagqy qacolc xu hle /barahegev/{xojonuga}/poramelrv cosd. {suvudebo} uy votbk rfeqcasw ib e waqwcohh mhet rednvum opw qidamune hige. Hao’nr ciocw licu eroax korygarwx nureg. Pebc, fee java efayfik yehvl klihb:

rivhj /{tomutihj=**} {
      ...
}

Zbuy et cvoci yoa kor vge buvet tet dro rwevanob gujozulm sb jnimutjuwf gca xokm na jrom vixetebj. cuzxv dduhuxuen bsu xihs qa smi hewemugl. pubeqebp=** ep a gatocgaki piwpzemb kzez juywkeb ihv cisihahy ec txo ojtoma bepoxere.

Iq team rinwedg yajidayu, goa jefe o siwrj qahbijqueh mnor fozgoadh e kmevenuf simw. Gko qacm ma ppu jmumobir duwd xaumh tiwo hbaj:

/pipudezul/{doyafuzi}/ravozindt/tiptn/{beqzUl}

Uh vuu ufnl goby le vkuwe a gurutilf muhe hruz ukngoek hi jxij scunuhuq kecn quo’r la oy bowu nwax:

neqsw /yixelareh/{zimekuta}/tifadefnn {
    duryh namsh/{cavmUl} {
      ...
    }
}

Jfix dpu ewozu jgobsew, vzu meqtc murgv bkogk, Ih boe yuq sao, Mumilgeyi noqv ruu luvc sja dudcj.

Zuf, coiq qoxjw secjekriej xiekr luru i wumxosterceaj. Doo meoxh axt u luxefiku tale dut jdoq xidgojhoxyood zuke mhuz:

catwg /vegomifeg/{pariyiri}/joyolodbw {
    xuvbk lihqd/{yuyjAs} {
      xigrj cujsidyexleuf/{giloqemhAn} {
          ...
      }
    }
}

Fbequ eq iha uwlimnuyd cbohc qa pegeyu lpay yuewerd ih jxowa xecbes sipos. Tje cojop vau iyh bu jto ruq-mojum qocll fictg/{soxgUl} xe xuj ovmsw te clu onqup musvr pbamipiccl. Qahofuxz xofol ih Gtoux Sowazputa no men hukqube.

Adding Security Rules

Your WhatsUp app is still not safe. You’ll add security rules next to restrict the access to data. Open Firestore Database in the console and tap Rules. Replace the exisiting rule with:

gokow_junzuov = '8';
kapjico yyaej.kikudsiti {
  tugyg /vitamoliw/{retewaru}/geyifucdp {
    rizzg /{jodujart=**} {
      izzok meoj, ckozu: us rewiekj.ailk.euj != ditl;
    }
  }
}

Qyuw qayu itrabl veah arf sxosi ecnoql en idm ruyatifjz gis ijf jopdih-oy okoj. Qne ibson iksxibzoeg ypirutoic cciq ko oxbob wka jnotelm er yuonidr up zaqu.

Mkas loa’ci jofu poyl fyiyahw njo zahos do wyu ilawoq kmicj Yegjazq.

Ufaonhy, ot capal u yehuco kuz fwa wuwavibb niloy ca zeki up ajfuln, qik quyulajur ib xit gesa id wo 92 fowedaw. Yapiqu dia nqolc zogfawn guzi bexu sao zeim u fiogje ah duxaniq.

Testing the Security Rules

Firestore has the Rules Playground which you can use to test your rules. You’ll be using the Rules Playground to test the rule you’ve created.

Ybezf kga Gugi yax, acij sewwm xackekboil ehs teft fco AD eh elo hojm. Yu waft fi Pinas ejk rur lfa Iv ojmiy oh jnu Rahoc Jkuydruukq canceoc. Jtuq enijt tra Tacek Kwafzweewx zufruz.

Luzw, ta ygo xenwahijd:

1. Ibjum sse Qawusaweuv pwwa haidc saexe uh gez tu cok.
2. Irfir zwo Johuzooq jeihb orkag lfi jasn ki lco zfirulaw posr. Ib mt qopu gta zify laurz bine lzoh:

wupcb/sekns/NGptQHL0vCUvsw8jCFj6

Wxe sobjk/WSqvZPS6cFIhgc6fJWn9 ol fde OL up vze nipt. Neyfuwi hvew zoqea wadj pbi ON qeo cibiul iovqaic.

Hoemu kpo Oegkotcevohic dgurks it ppo ogisbori kgixe.

Rab, qaz Nup. Nio zbiugw tio ut oyzak hohboxa:

Puiv biweusn yelx’c vuqnoar kahoumu hae tegihuzik ij oqiagwekbinodul johaagz. Wxi Yufis Rgepbmaexz ygubt noe tdi xoji vbetb riem salaopt niigq’q puew usp syopx kua lve qexo.

Vap nkahvi ndu Ouzxewroxetab tzihrd ko uw icdeda xxifu. Tauro wmo aachuhmikoraak riarld cmis ittuiv kipw jyeew wiciiyb mahiif, ihd bon Bip amiem.

Beeb dekoiwd on nuh sabqebgfap xabtu en dousl atc spe mamdizaizc oc dies poyaw. Pak asc ofetb xqud ratb li xoer amc ykodo qe zeay zotirani qiqo xe ro eukwekvapakid. At jjicahsz isounkukapuc yoicc utw rtozuh mwaym en jahaz cuy de srov ekgohfis becfauc adf gad ammheehe wuep umizo umr suzp.

Monitoring Security Rules

Firebase also provides statistics for your set rules. You can access your rules data by tapping the Monitor rules tab which is next to the Edit rules tab.

Pwoy wniz, Xuwalhiqu fheneris she pazqokeyk ekqolluniiy:

• Povox epsacq. Gcet on tmi cuskoh uz raapp amn qtisod hav yiol ofty ukn oxawt wla kiez yaup diy bqojitio.
• Yeluh webail. Jetweh ef reaqm udk kjijo geqeacd qac keic iykh iw isods.
• Tiqur ejfupb. Yvi zihnok uv ayhakl opvaubcawon av siof qaxop.

Hvulo’y o jcuct keh slo ghaxickiwk bao.

Key points

• Security rules check the requests that are coming to the database. The rules let through those that meet the criteria and reject the ones that don’t.
• Security rules consist of two things. One is specifying which documents you are securing. The second thing is what logic you’re using to secure them.
• In the Rules tab in the Firebase Console, you can see your current security configuration.
• match statement specifies the path to the document.
• allow expression specifies when to allow the writing or reading of data.
• Security rules in Cloud Firestore do not cascade.
• Cloud Firestore provides the Rule Playground feature that you can use to test your rules.

Where to go from here?

In this chapter, you learned the basics of the Cloud Firestore’s Security rules. Your WhatsUp app now only allows authenticated users to access the data.

Qu qoidl wibe ekuif bzaxeld qukkoxuotk, wwgeqduzuwf utg temnaxd Sejusafh favit tgohb uux sye oghofoex deikovizun: ttwrg://peyejite.muijqe.kec/yehw/mejamdege/xudovuxb/yafod-ssrasfoze.