避免不安全的規則

使用本指南了解 Firebase 安全規則配置中的常見漏洞，審查並更好地保護您自己的規則，並在部署之前測試您的更改。

如果您收到有關您的數據未得到妥善保護的警報，請查看這些常見錯誤並更新任何易受攻擊的規則。

訪問您的 Firebase 安全規則

要查看現有規則，請使用 Firebase CLI 或 Firebase 控制台。確保使用相同的方法一致地編輯規則，以避免錯誤地覆蓋更新。如果您不確定本地定義的規則是否反映了最新更新，Firebase 控制台始終會顯示最新部署的 Firebase 安全規則版本。

要從Firebase 控制台訪問您的規則，請選擇您的項目，然後導航到實時數據庫、 Cloud Firestore或存儲。進入正確的數據庫或存儲桶後，單擊規則。

要從 Firebase CLI 訪問您的規則，請轉到您的firebase.json 文件中記錄的規則文件。

了解 Firebase 安全規則

Firebase 安全規則保護您的數據免受惡意用戶的侵害。在 Firebase 控制台中創建數據庫實例或 Cloud Storage 存儲桶時，您可以選擇拒絕所有用戶訪問（鎖定模式）或授予所有用戶訪問權限（測試模式）。雖然在開發過程中您可能需要更開放的配置，但請確保在部署應用程序之前花時間正確配置規則並保護數據。

當您開發應用程序並測試規則的不同配置時，請使用本地 Firebase 模擬器之一在本地開發環境中運行您的應用程序。

具有不安全規則的常見場景

在部署應用程序之前，應檢查和更新您可能默認設置的規則或您最初開發應用程序時設置的規則。通過避免以下常見陷阱，確保您正確保護用戶數據。

開放獲取

在設置 Firebase 項目時，您可能已設置規則以允許在開發期間進行開放訪問。您可能認為您是唯一使用您的應用程序的人，但如果您部署了它，它就可以在 Internet 上使用。如果您不對用戶進行身份驗證和配置安全規則，那麼任何猜測您的項目 ID 的人都可以竊取、修改或刪除數據。

// Allow read/write access to all users under any conditions
// Warning: **NEVER** use this ruleset in production; it allows
// anyone to overwrite your entire database.

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

{
  // Allow read/write access to all users under any conditions
  // Warning: **NEVER** use this ruleset in production; it allows
  // anyone to overwrite your entire database.

  "rules": {
    ".read": true,
    ".write": true
  }
}
    

// Anyone can read or write to the bucket, even non-users of your app.
// Because it is shared with App Engine, this will also make
// files uploaded via App Engine public.
// Warning: This rule makes every file in your Cloud Storage bucket accessible to any user.
// Apply caution before using it in production, since it means anyone
// can overwrite all your files.

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write;
    }
  }
}
    

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow only authenticated content owners access
    match /some_collection/{document} {
      allow read, write: if request.auth != null && request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow public read access, but only content owners can write
    match /some_collection/{document} {
      allow read: if true
      allow write: if request.auth != null && request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

{
  "rules": {
    "some_path": {
      "$uid": {
        // Allow only authenticated content owners access to their data
        ".read": "auth !== null && auth.uid === $uid",
        ".write": "auth !== null && auth.uid === $uid"
      }
    }
  }
}
    

{
  // Allow anyone to read data, but only authenticated content owners can
  // make changes to their data

  "rules": {
    "some_path/$uid": {
      ".read": true,
      // or ".read": "auth.uid !== null" for only authenticated users
      ".write": "auth.uid === $uid"
    }
  }
}
    

// Grants a user access to a node matching their user ID
service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read;
      allow write: if request.auth.uid == userId;
    }
  }
}
  

任何經過身份驗證的用戶的訪問權限

有時，規則會檢查用戶是否已登錄，但不會進一步限制基於該身份驗證的訪問。如果您的規則之一包括auth != null ，請確認您希望任何登錄用戶都可以訪問數據。

service cloud.firestore {
  match /databases/{database}/documents {
    match /some_collection/{document} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

{
  "rules": {
    ".read": "auth.uid !== null",
    ".write": "auth.uid !== null"
  }
}

// Only authenticated users can read or write to the bucket
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

service cloud.firestore {
  match /databases/{database}/documents {
    // Assign roles to all users and refine access based on user roles
    match /some_collection/{document} {
     allow read: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "Reader"
     allow write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "Writer"

     // Note: Checking for roles in your database using `get` (as in the code
     // above) or `exists` carry standard charges for read operations.
    }
  }
}

// Give each user in your database a particular attribute
// and set it to true/false
// Then, use that attribute to grant access to subsets of data
// For example, an "admin" attribute set
// to "true" grants write access to data

service cloud.firestore {
  match /databases/{database}/documents {
    match /collection/{document} {
      allow write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.admin == true;
      allow read: true;
    }
  }
}
  

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow public read access, but only content owners can write
    match /some_collection/{document} {
      allow read: if true
      allow write: if request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

{
  "rules": {
    "some_path": {
      "$uid": {
        // Allow only authenticated content owners access to their data
        ".read": "auth.uid === $uid",
        ".write": "auth.uid === $uid"
      }
    }
  }
}
    

{
  "rules": {
    "some_path/$uid": {
      ".write": "auth.uid === $uid",
      // Create a "public" subpath in your dataset
      "public": {
        ".read": true
        // or ".read": "auth.uid !== null"
      },
      // Create a "private" subpath in your dataset
      "private": {
        ".read": "auth.uid === $uid"
      }
    }
  }
}
    

{
  // Allow anyone to read data, but only authenticated content owners can
  // make changes to their data

  "rules": {
    "some_path/$uid": {
      ".read": true,
      // or ".read": "auth.uid !== null" for only authenticated users
      ".write": "auth.uid === $uid"
    }
  }
}
    

// Allow reads if the group ID in your token matches the file metadata's `owner` property
// Allow writes if the group ID is in the user's custom token
match /files/{groupId}/{fileName} {
  allow read: if resource.metadata.owner == request.auth.token.groupId;
  allow write: if request.auth.token.groupId == groupId;
}

// Grants a user access to a node matching their user ID
service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read;
      allow write: if request.auth.uid == userId;
    }
  }
}
  

（實時數據庫）不正確的繼承規則

實時數據庫規則級聯，更淺的父路徑規則覆蓋更深的子節點規則。當您在子節點編寫規則時，請記住它只能授予額外的權限。您無法優化或撤銷對數據庫中更深層路徑的數據的訪問。

{
  "rules": {
     "foo": {
        // allows read to /foo/*
        ".read": "data.child('baz').val() === true",
        "bar": {
          /* ignored, since read was allowed already */
          ".read": false
        }
     }
  }
}

封閉式訪問

在開發應用程序時，另一種常見方法是鎖定數據。通常，這意味著您已關閉所有用戶的讀寫訪問權限，如下所示：

// Deny read/write access to all users under any conditions
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

{
  "rules": {
    ".read": false,
    ".write": false
  }
}
    

// Access to files through Cloud Storage is completely disallowed.
// Files may still be accessible through App Engine or Google Cloud Storage APIs.

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}

Firebase Admin SDK 和 Cloud Functions 仍然可以訪問您的數據庫。當您打算將 Cloud Firestore 或實時數據庫用作與 Firebase Admin SDK 結合使用的純服務器後端時，請使用這些規則。雖然它是安全的，但您應該測試您的應用程序的客戶端是否可以正確檢索數據。

在 Cloud Firestore 安全規則入門 中了解有關 Cloud Firestore 安全規則及其工作原理的更多信息。

測試您的 Cloud Firestore 安全規則

要檢查您應用的行為並驗證您的 Cloud Firestore 安全規則配置，請使用Firebase 模擬器。在部署任何更改之前，使用 Cloud Firestore 模擬器在本地環境中運行和自動化單元測試。

要在 Firebase 控制台中快速驗證 Firebase 安全規則，請使用Firebase 規則模擬器。