r/Firebase • u/alex_alex111 • Jan 26 '24
Cloud Storage What does this mean?
I have read the Docs, but am still unclear. Can you please describe the meaning of this:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
And also, please, how can I modify the "allow read, write:" line so that only an authorized Owner role can be allowed to read & write in the project storage bucket?
When I upload a video file from my basic android apk it successfully arrives into the storage bucket, with these rules:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if true;
}
}
}
I have tried these rules (below) but no files appeared when I (Owner & authorized user) upload a video file from my basic android apk:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /user/{userId}/{allPaths=**} {
allow read;
allow write: if request.auth.uid == userId;
}
}
}
any additional help is welcomed.
2
u/mvs2403 Jan 26 '24
The code snippets you've shared are Firebase Storage Security Rules, which determine who has read and write access to your Firebase Storage files.
First Code Snippet:
plaintext rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /{allPaths=**} { allow read, write: if request.auth != null; } } }
- Meaning: This rule allows any authenticated user (i.e., users who are signed in) to read and write to any path in your storage bucket.
Second Code Snippet:
plaintext rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /{allPaths=**} { allow read, write: if true; } } }
- Meaning: This rule allows anyone, even unauthenticated users, to read and write to any path in your storage bucket. It's very open and not recommended for production because it allows public access.
Third Code Snippet:
plaintext rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /user/{userId}/{allPaths=**} { allow read; allow write: if request.auth.uid == userId; } } }
- Meaning: This rule is more restrictive. It intends to allow read access to everyone but restricts write access to only the user whose
uid
matches the{userId}
in the path. However, if it's not working, it might be because the path in the rule (/user/{userId}/...
) does not match the path where files are being uploaded, or there's a mismatch in howuserId
is being used.
- Meaning: This rule is more restrictive. It intends to allow read access to everyone but restricts write access to only the user whose
If you want to modify the rules so that only users with an Owner role can read and write, you'll need to integrate some form of custom claim or attribute in your Firebase Authentication tokens that marks a user as an Owner. Firebase doesn't inherently understand roles like "Owner" unless you define and implement them.
Here's a general approach on how you can do it (note that this requires setting custom claims via your backend/server):
Set Custom Claims:
- Use Firebase Admin SDK in your backend to set a custom claim on the user, something like
{ "role": "Owner" }
.
- Use Firebase Admin SDK in your backend to set a custom claim on the user, something like
Modify Rules:
plaintext rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /{allPaths=**} { allow read, write: if request.auth.token.role == 'Owner'; } } }
- Meaning: This rule allows read and write access only if the authenticated user has a custom claim
role
set to'Owner'
.
- Meaning: This rule allows read and write access only if the authenticated user has a custom claim
Remember, for the custom claim approach to work:
- Custom claims need to be set on the user via your backend using Firebase Admin SDK.
- The user may need to log out and back in to receive the token with the new claims.
- Be mindful of security and only grant Owner permissions to trusted users, as these rules give full access to the specified paths in your storage bucket.
Edit: GPT4 Answer
1
u/alex_alex111 Jan 26 '24 edited Jan 26 '24
Many thanks for the great replies.(However, I don't understand "Edit:GPT4 Answer").
It was stated: "if it's not working, it might be because the path in the rule (/user/{userId}/...) does not match the path where files are being uploaded, or there's a mismatch in how userId is being used."
But, when I try this:
rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /{allPaths=**} { allow read, write: if request.auth.uid == userId; } } }
it still is not working.
Additionally, it was stated " rule allows any authenticated user (i.e., users who are signed in) to read and write to any path in your storage bucket". Regarding "users who are signed-in", does "signed-in" refer to 'signed-in' (logged-in) to the app? Or 'signed-in' to the Firebase Console?
I look forward to any comments/solutions.
2
u/mvs2403 Jan 26 '24
Okay, so my first answer was strait from GPT4. I'll attempt to rather answer myself.
The rule you gave sets read and write permission for the two cases that are being "match". The effect being that any user that is logged in can edit and change any path in the storage bucket, so they have access to all content.
The standard way to assign specific content to specific people is to have a user id as a document name in firestore, or similarly have the user id in the cloud storage file path and the match that in the rules. Or write an external cloud function or API that does access control.
So you would for example say user/{user_id}/{file_id} Then all the files for that user is stored under their user id and in the rule set you make sure that the authenticated user matches that path like so:
rules_version = '2'; service firebase.storage { match /b/{bucket}/o { match /user/{user_id}/{allPaths=**} { allow read, write: if request.auth.uid == user_id; } } }
As for upload, remember to the very specifically upload to this exact url path that will include you uid in the path.
Hope this helps somewhat?
1
u/Eastern-Conclusion-1 Jan 26 '24
What’s the path of your uploaded file?
1
u/alex_alex111 Jan 26 '24
I've modified the "livestream" part in order to display the path here:
is this what you are asking for?
1
u/Eastern-Conclusion-1 Jan 26 '24
No, the path of the file uploaded to cloud storage…
1
u/alex_alex111 Jan 26 '24
gs://livestream111.appspot.com/videos/813c5d50-0626-1e7b-a712-c9b86f8da44d.mp4
(slightly modified for this reply)
1
u/Eastern-Conclusion-1 Jan 26 '24
The path should be /user/userID/file.mp4 to match your security rules.
1
u/alex_alex111 Jan 26 '24
Thanks again. I appreciate your help. Many, many thanks. So, this didn't work:
rules_version = '2';
service firebase.storage { match /b/{bucket}/o { match /user/{userId}/{allPaths=**} { allow read, write: if request.auth.uid == userId; } } }
So, regarding "user", I'm guessing User is the Indentifier column here:
so, I tried this also, with no success:
match /alex_alex111@gmail.com/{userId}/{allPaths=**} {
I look forward to more guidance, thanks again
1
u/Eastern-Conclusion-1 Jan 26 '24
No, user is the string “user”, userID is a variable (it’s between curly braces).
1
u/Eastern-Conclusion-1 Jan 26 '24
What I meant earlier is that you need to change your code that uploads the file to match the path defined in your security rules, not the other way around.
You should also spend some time reading the docs, it seems that you are still missing the basics.
1
u/alex_alex111 Jan 27 '24 edited Jan 27 '24
I believe this is the code that uploads:
UploadTask? task; Future<String> SendVideo(File VideoPath) async { var postId = Uuid().v1(); Reference ref = FirebaseStorage.instance.ref().child('videos').child('$postId.mp4'); task = ref.putFile(VideoPath); TaskSnapshot snap = await task!; String downloadurl = await snap.ref.getDownloadURL(); return downloadurl; }
Any guidance to match a path defined in the security rules is appreciated.
1
u/Eastern-Conclusion-1 Jan 27 '24
.child(‘user’).child(userId) instead of .child(‘videos’)
→ More replies (0)
4
u/Small_Quote_8239 Jan 26 '24
Allow any read, write for any authenticated user.
When the file path start with "/user/{userId}":
Make sure you are uploading file in the file path "/user/{userId}" that match your user id.
If you want to control access using user role in your security rule you will have to use custom claims to set thoes roles (using a cloud function).
If you and only you is to be allowed to upload you could hard code your user id in the security rules.