Question

Firebase rules let anyone read my whole users collection

Solved · 8 views · asked 6 days ago by dana_ships · edited

Windsurf wrote my Firestore rules. The app works, but when I paste my project URL into a fresh browser and run a query in the console I get every user's document back.

match /users/{userId} {
  allow read, write: if true;
}

What I’ve tried

Asked Windsurf to "make it secure", it added request.auth != null but I can still read other people's documents when logged in as anyone.

Comment

2 answers

Marked as helpful by the asker

sven_fire5 days ago · edited

request.auth != null only means somebody is logged in. You want this user:

match /users/{userId} {
  allow read, write: if request.auth != null && request.auth.uid == userId;
}

Run the Rules Playground in the console with a different uid to confirm it denies. And rotate nothing: Firebase API keys are public by design, the rules are your only lock.

Comment

lena_ops5 days ago · edited

Also check match /{document=**} at the top of the file. Windsurf loves to leave a catch-all allow read: if true there that overrides everything below it.

Comment

Keyboard shortcuts

Firebase rules let anyone read my whole users collection

What I’ve tried

2 answers

Your answer

Firebase rules let anyone read my whole users collection

What I’ve tried

2 answers

Related

Your answer