Getting a client URL to Firebase Cloud Storage that comply with storage rules

Question

I have a web application on Firebase where I create a Firestore document with a reference to a Firebase Storage file.

I've setup rules on Firebase Storage to only allow read: if request.auth != null.

Since Firestore complies with similar rules I am able to ensure that access to my Firestore document is only possible, when a user is authenticated, but how do I best about enforcing the same rule in my web application to the Firebase Storage file?

1. I can use getDownloadUrl() when I've uploaded the file and store the URL in my Firestore document. - But URL is always public to anyone
2. I can create a Firebase Function that on each request checks authentication and if authenticated, generate a getSignedUrl() with an expiration of say 5 minutes and then do a 302 redirect to the temp public URL - but that does not comply with Firebase Storage rules so I need to replicate any new rulesets in the function

Why can't Firebase Storage not simply behave like Firestore and check the auth on a http request and return the file is it complies with rules?

Am I totally missing a 3) and better option to make sure a user is logged in before accessing a file from storage?

Answer 1

According to the Cloud Storage for Firebase Documentation you can now access files through the Web SDK.

From version 9.5 and higher, the SDK provides these functions for direct download:

• getBlob()
• getBytes()
• getStream()

Using these functions, you can bypass downloading from a URL, and instead return data in your code. This allows for finer-grained access control via Firebase Security Rules.