Search code examples
google-cloud-firestorefirebase-securityfirebase-console

why is firebase firestore rule denies write, indicating '...==...' and '&&' as false

Firestore security rules denying access.

Rules are:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{id} {
      allow create, update, delete: if request.auth != null && request.auth.uid == id;
      allow read: if request.auth != null;
    }
  }
}

playground rules indicate '...==...' and '&&' as false. What is wrong with this? Help appreciated very much!

Full rules and screenshot:

enter image description here

Solution 
  • allow create, update, delete: if request.auth != null && request.auth.uid == id;

    From your screenshot, you are running an update simulation.

    1. request.auth != null will fail if user is not logged in.
    2. request.auth.uid == id will fail if uid != id;

    From your screenshot, we can see that authenticated is set to true. Therefore condition 1 will pass. It is presently failing because of the 2nd condition. request.auth.uid == id

    Presently, the id == 'user', but request.auth.uid != 'user';

    Solution. Set your request.auth.uid to 'user'. To do that, go under authenticated, under firebase UID, put 'user' (as your firebase uid). It should work.

    NB: it is possible that you are not struturing your data properly. Your present data structure is something like 'users/user', instead it should be 'users/{userId}' where userId is generated by firebase when user creates account.