避免使用不安全的規則

本指南說明「Firebase Security Rules」的常見安全漏洞 自行設定規則，檢查並加強保護自己的規則。 並在部署變更前進行測試

如果系統通知您資料可能不安全， 查看這些常見錯誤，並更新任何有安全漏洞的規則。

使用 Firebase Security Rules

如要查看現有Rules，請使用 Firebase CLI 或 Firebase 控制台。請務必使用相同的方式編輯規則 以避免意外覆寫更新。如果您不確定 無論您在本機定義的規則是否反映最近的更新 控制台一律會顯示 Firebase Security Rules 最近部署的版本。

如要透過 Firebase 控制台存取規則，請選取 ，然後前往 Realtime Database、Cloud Firestore 或 儲存空間：連結至正確的資料庫或儲存空間後，按一下「規則」 Cloud Storage 也提供目錄同步處理功能 方便您同步處理 VM 目錄與值區

如要透過 Firebase CLI 存取規則，請前往 在 firebase.json 檔案中記下的規則。

瞭解 Firebase Security Rules

Firebase Security Rules 可防範惡意使用者侵害你的資料。建立資料庫時 Firebase 控制台中的執行個體或 Cloud Storage 值區，您可以 您可以選擇拒絕所有使用者的存取權 (鎖定模式)，或是授予 所有使用者 (測試模式)。當您希望在實際工作環境中 請務必花些時間正確設定規則 確保資料安全，再部署應用程式。

開發應用程式及測試不同設定 規則，請使用其中一個本機 Firebase 模擬器執行您的應用程式 在本機開發環境中。

規則不安全的常見情況

您可能已預設或一開始就設定的 Rules 在開發應用程式時致力接受審查及更新 再部署應用程式確認您已妥善保護使用者資料 有助於避免下列常見錯誤

開放存取

設定 Firebase 專案時，您可能已將規則設為允許開啟 存取資源您可能會以為自己是唯一使用 但如果您已部署應用程式，則可在網際網路上取得。如果不是 驗證使用者並設定安全性規則，一切有把握 專案 ID 可竊取、修改或刪除資料。

// Allow read/write access to all users under any conditions
// Warning: **NEVER** use this ruleset in production; it allows
// anyone to overwrite your entire database.

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

{
  // Allow read/write access to all users under any conditions
  // Warning: **NEVER** use this ruleset in production; it allows
  // anyone to overwrite your entire database.

  "rules": {
    ".read": true,
    ".write": true
  }
}
    

// Anyone can read or write to the bucket, even non-users of your app.
// Because it is shared with App Engine, this will also make
// files uploaded via App Engine public.
// Warning: This rule makes every file in your Cloud Storage bucket accessible to any user.
// Apply caution before using it in production, since it means anyone
// can overwrite all your files.

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write;
    }
  }
}
    

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow only authenticated content owners access
    match /some_collection/{document} {
      allow read, write: if request.auth != null && request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow public read access, but only content owners can write
    match /some_collection/{document} {
      allow read: if true
      allow write: if request.auth != null && request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

{
  "rules": {
    "some_path": {
      "$uid": {
        // Allow only authenticated content owners access to their data
        ".read": "auth !== null && auth.uid === $uid",
        ".write": "auth !== null && auth.uid === $uid"
      }
    }
  }
}
    

{
  // Allow anyone to read data, but only authenticated content owners can
  // make changes to their data

  "rules": {
    "some_path/$uid": {
      ".read": true,
      // or ".read": "auth.uid !== null" for only authenticated users
      ".write": "auth.uid === $uid"
    }
  }
}
    

// Grants a user access to a node matching their user ID
service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read;
      allow write: if request.auth.uid == userId;
    }
  }
}
  

所有已驗證使用者的存取權

有時候，Rules 會檢查使用者已經登入，但不會進一步 根據該驗證來限制存取權如果您的某項規則 auth != null，請確認您要將 資料。

service cloud.firestore {
  match /databases/{database}/documents {
    match /some_collection/{document} {
      allow read, write: if request.auth.uid != null;
    }
  }
}

{
  "rules": {
    ".read": "auth.uid !== null",
    ".write": "auth.uid !== null"
  }
}

// Only authenticated users can read or write to the bucket
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

service cloud.firestore {
  match /databases/{database}/documents {
    // Assign roles to all users and refine access based on user roles
    match /some_collection/{document} {
     allow read: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "Reader"
     allow write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "Writer"

     // Note: Checking for roles in your database using `get` (as in the code
     // above) or `exists` carry standard charges for read operations.
    }
  }
}

// Give each user in your database a particular attribute
// and set it to true/false
// Then, use that attribute to grant access to subsets of data
// For example, an "admin" attribute set
// to "true" grants write access to data

service cloud.firestore {
  match /databases/{database}/documents {
    match /collection/{document} {
      allow write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.admin == true;
      allow read: true;
    }
  }
}
  

service cloud.firestore {
  match /databases/{database}/documents {
    // Allow public read access, but only content owners can write
    match /some_collection/{document} {
      allow read: if true
      allow write: if request.auth.uid == request.resource.data.author_uid
    }
  }
}
  

{
  "rules": {
    "some_path": {
      "$uid": {
        // Allow only authenticated content owners access to their data
        ".read": "auth.uid === $uid",
        ".write": "auth.uid === $uid"
      }
    }
  }
}
    

{
  "rules": {
    "some_path/$uid": {
      ".write": "auth.uid === $uid",
      // Create a "public" subpath in your dataset
      "public": {
        ".read": true
        // or ".read": "auth.uid !== null"
      },
      // Create a "private" subpath in your dataset
      "private": {
        ".read": "auth.uid === $uid"
      }
    }
  }
}
    

{
  // Allow anyone to read data, but only authenticated content owners can
  // make changes to their data

  "rules": {
    "some_path/$uid": {
      ".read": true,
      // or ".read": "auth.uid !== null" for only authenticated users
      ".write": "auth.uid === $uid"
    }
  }
}
    

// Allow reads if the group ID in your token matches the file metadata's `owner` property
// Allow writes if the group ID is in the user's custom token
match /files/{groupId}/{fileName} {
  allow read: if resource.metadata.owner == request.auth.token.groupId;
  allow write: if request.auth.token.groupId == groupId;
}

// Grants a user access to a node matching their user ID
service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    // Files look like: "user/<UID>/path/to/file.txt"
    match /user/{userId}/{allPaths=**} {
      allow read;
      allow write: if request.auth.uid == userId;
    }
  }
}
  

(Realtime Database) 規則沿用不當

Realtime Database Security Rules 串聯，且規則範圍是較淺的，父項路徑覆寫 可建立更深層的子節點在子節點寫入規則時 授予對方其他權限您無法修正或撤銷 可在資料庫中更深入的路徑存取資料。

{
  "rules": {
     "foo": {
        // allows read to /foo/*
        ".read": "data.child('baz').val() === true",
        "bar": {
          /* ignored, since read was allowed already */
          ".read": false
        }
     }
  }
}

禁止存取

開發應用程式時，另一種常見的做法是 資料就會遭到鎖定通常這表示您已經關閉讀取和寫入功能 並開放所有使用者使用，方法如下：

// Deny read/write access to all users under any conditions
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

{
  "rules": {
    ".read": false,
    ".write": false
  }
}
    

// Access to files through Cloud Storage is completely disallowed.
// Files may still be accessible through App Engine or Google Cloud Storage APIs.

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}

Firebase Admin SDK 和 Cloud Functions 仍可存取 資料庫打算使用 Cloud Firestore 或 Realtime Database 是僅限伺服器 並與 Firebase 搭配使用 Admin SDK。雖然安全無虞，但您應測試應用程式的用戶端 以便正確擷取資料

進一步瞭解 Cloud Firestore Security Rules 及其運作方式 開始使用 Cloud Firestore Security Rules。

測試 Cloud Firestore Security Rules

如要查看應用程式行為並驗證 Cloud Firestore Security Rules 設定， 請使用 Firebase 模擬器。使用「Cloud Firestore」 模擬器，在部署前先在本機環境中執行及自動化單元測試 任何變更

如要在 Firebase 控制台中快速驗證 Firebase Security Rules，請使用 Firebase 規則模擬工具。