Cloud Storage - Disabled Public Access Prevention, but Failed

Question

Okay, I was using Flutter and Firebase to upload data into Cloud Storage. I gained the downloadURL which can be accessible on web if people know the URL. I had enabled Public Access Prevention in Google Cloud Storage Console based on this doc and chose Access Control Uniform for this on doc.

I also had added Security Rule in Firebase Cloud Storage, so only Users with certain custom token can use it. But, it seems useless as everyone can get its downloaded URL. My question is why is that I still able to access the file if I am using the same URL which was I stored in Firestore? You can test it on this url.

Can hacker get the download URL I downloaded from Firestore? Is there a secure way to download song from Firebase Cloud Storage so hacker won't get its URL?

Thank you for helping me out.

Updated v2: I just found out that current audio file has its own AuthenticatedUrl as shown on this picture below. How can I get access to this url?

Updated v1:

I think I haven't activated Firebase App Check. Does this feature have ability to prevent it from being accessed publicly or maybe there is other things that I have to do to be able to prevent it being accessed publicly, beside all ways I described above???

Answer 1

Security rules only check if a user can get the download URL and do not restrict anyone from using it. You can use the getData() method instead. It doesn't return any URL and downloads the files directly and is controlled by security rules. So a user must be authenticated to fetch them.