Security RulesBeginner
1Question 1 of 1
javascriptHow do Firebase Security Rules protect Firestore data from unauthorized access?
Explanation & Concept
Security Rules run on Google's servers before any read or write operation executes. They evaluate authentication state (`request.auth`), incoming data (`request.resource.data`), and existing database state (`resource.data`) to permit or deny access.
Code Example
javascript
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// Users can only read and write their own profile document
match /users/{userId} {
allow read: if request.auth != null;
allow write: if request.auth != null && request.auth.uid == userId;
}
// Anyone can read public posts, but only authors can edit
match /posts/{postId} {
allow read: if true;
allow create: if request.auth != null && request.resource.data.authorId == request.auth.uid;
allow update, delete: if request.auth != null && resource.data.authorId == request.auth.uid;
}
}
}How It Works & Key Takeaways
Security Rules guarantee that malicious clients interacting directly with the Firestore client SDK cannot manipulate or access other users' data.
Mock Test · 1 Questions · Optional
Ready for Firebase Hosting?
Take a quick test to evaluate yourself, or move straight to the next module.
Intermediate1 questions