Breaking News: Grepper is joining You.com. Read the official announcement!

Client access to your Cloud Firestore database has expired edit rules

Easy Eagle answered on November 4, 2021 Popularity 1/10 Helpfulness 1/10

answer Client access to your Cloud Firestore database has expired edit rules

Client access to your Cloud Firestore database has expired edit rules

Comment

The security rules shown here are a departure from the previous default rules that were much more permissive. The idea with this rule:

match /{document=**} {
  allow read, write: if request.time < timestamp.date(2019, 12, 14);
}
Is that you get unrestricted access to your Firestore database up until the given date, in order to freely experiment with it for a month. However, allowing unrestricted access is obviously a massive security hole in the long run.

The recommended course of action is to first remove this rule entirely as it allows anyone to read and write anything in your database. Then, devise some proper rules that allow only access to collections and documents that your eventual users should be able to access. A full discussion of that is off-topic for Stack Overflow (as we don't know your app's requirements), but here are some good places to start learning about security rules:

The documentation
This video series
What you should be doing is calling out the access constraints for each collection and subcollection in your database. Ideally, you should lock down unauthenticated write access to all collections, except where absolutely required. In the best case, you're using Firebase Authentication to help control access to documents only as required for authenticated users.

Alternatively, if you're done working with the database (for the time being), you can block access to the database from web and mobile client entirely by using the following rule exclusively:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    allow read, write: if false;
  }
}
With this rule, access from backend code using the Firebase Admin SDK or other Cloud SDKs will still be allowed.

Popularity 1/10 Helpfulness 1/10 Language whatever

Source: stackoverflow.com

Tags: client cloud database edit rules whatever

Link to this answer
Share Copy Link

Contributed on Nov 04 2021

Easy Eagle

0 Answers Avg Quality 2/10

Client access to your Cloud Firestore database has expired edit rules

Contents

More Related Answers

Client access to your Cloud Firestore database has expired edit rules

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.