Search code examples
firebasegoogle-cloud-firestorefirebase-storagefirebase-security

Role based rules in firebase storage

I have a database having multiple groups - each having their own roles (admins, mods, etc..)

I have rules setup on firestore.

How do I replicate that on storage rules ?

Solution

  • To put it briefly, you can't without serious modifications.

    Storage rules can't access Firestore documents. So all of the relationship you have in Firestore can not be used in Storage.

    You can use Firebase Auth custom claims to attach per-user data that can be used in both Firestore and Storage, but this means you will have to duplicate that relationship data into those claims and keep them in sync in backend code.

    You can also duplicate data from Firestore into metadata attached to files in Storage, and use that metadata in security rules to determine who can read or write individual files.

    These are your only viable options without creating your own backend API endpoints that enforce security.