1. Introduction

Goal of the Tutorial

This tutorial aims to guide you through the process of writing Firebase Security Rules for authenticated users. Firebase Security Rules provide robust, customizable protection for your Firebase project's resources, and understanding how to write them is crucial to maintaining secure data.

What You'll Learn

By the end of this tutorial, you'll understand:

• What Firebase Security Rules are.
• How to write Firebase Security Rules for authenticated users.
• Best practices when writing Firebase Security Rules.

Prerequisites

Before starting this tutorial, it's recommended that you have:

• Basic understanding of Firebase.
• Familiarity with JavaScript or JSON syntax.

2. Step-by-Step Guide

Firebase Security Rules

Firebase Security Rules are server-side rules that control the access to your Firebase resources (Firestore, Storage, etc.). These rules are written in a JSON-like configuration language and are hosted and maintained by Firebase.

Writing Security Rules for Authenticated Users

To write Firebase Security Rules for authenticated users, we need to use the auth variable provided by Firebase. This variable contains the uid of the currently authenticated user, or it's null if no user is authenticated.

Consider the following example:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow read/write access on all documents to any user authenticated
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

In the above example, request.auth != null checks if a user is authenticated. If a user is authenticated, they can read and write to any document in your Firestore database.

3. Code Examples

Example 1: Restricting Write Access

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow read access to all, but only allow write access to authenticated users
    match /{document=**} {
      allow read: if true;
      allow write: if request.auth != null;
    }
  }
}

Here, read access is open to everyone, but write access is only for authenticated users (request.auth != null).

Example 2: User-specific Document Access

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Match the authenticated user's UID to the 'users' document UID
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

In this example, a user can only read and write to their own document in the 'users' collection (request.auth.uid == userId).

4. Summary

• Firebase Security Rules control the access to your Firebase resources.
• These rules are written in a JSON-like configuration language.
• request.auth variable is used to check whether a user is authenticated.
• To write security rules for authenticated users, you match request.auth with the desired condition.

Next Steps

• Try writing rules that incorporate Firestore data validation.
• Experiment with complex rules that involve multiple conditions.

Additional Resources

• Firebase Security Rules Documentation

5. Practice Exercises

1. Write a rule that allows authenticated users to only read data from a collection named "products".

2. Hint: Use match /products/{product} and limit read operation.

3. Write a rule that allows users to write to a document in the "profiles" collection only if the document ID matches their user ID.

4. Hint: Use match /profiles/{userId} and limit write operation to request.auth.uid == userId.

Solutions

1. rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /products/{product} { allow read: if request.auth != null; } } }

2. ```
   rules_version = '2';
   service cloud.firestore {
     match /databases/{database}/documents {
       match /profiles/{userId} {
         allow write: if request.auth != null && request.auth.uid == userId;
       }
     }
   }
   ```
   

   Copy

In both solutions, we're ensuring that a user is authenticated before they can access the data. In the second exercise, we're also ensuring the user can only write to their own profile by matching the user ID with the document ID.

Remember, practicing with real-world scenarios will help you to better understand Firebase Security Rules.