[Video](https://www.youtube.com/watch?v=PUBnlbjZFAI)

Traditionally, security has been one of the most complex parts of app
development. In most applications, developers must build and run a server that
handles authentication (who a user is) and authorization (what a user can do).
Authentication and authorization are hard to set up, harder to get right, and
critical to the success of your product.

Similar to how Firebase Authentication makes it easy for you to authenticate your
users, Firebase Security Rules for Cloud Storage makes it easy for you to authorize users
and validate requests. Cloud Storage Security Rules manage the complexity for you by
allowing you to specify path based permissions. In just a few lines of code, you
can write authorization rules that restrict Cloud Storage requests to a
certain user or limit the size of an upload.

> [!NOTE]
> **Note:** If you use Google App Engine and have a default Cloud Storage bucket with a name format of `*.appspot.com`, you may need to consider [how your security rules impact access to App Engine files](https://firebase.google.com/docs/storage/gcp-integration.md.txt#security-rules-and-app-engine-files).

The Firebase Realtime Database has a similar feature, called
[Firebase Realtime Database Security Rules](https://firebase.google.com/docs/database/security.md.txt)

### AI prompt for AI assistance


***For AI assistance, copy the prompt below into your
AI coding agent
(like Gemini in Android Studio, Antigravity, Claude Code, Codex, and Cursor).**
You can customize the prompt and iterate with your agent. Visit
[Firebase agent skills](https://firebase.google.com/docs/ai-assistance/agent-skills.md.txt)
for detailed installation info.*

```
Help me use Firebase in my app.
1. Make sure that **Firebase agent skills** are installed and updated. For Claude Code, Codex, or Cursor agents, help me install the Firebase plugin. For other agents, run `npx skills add firebase/agent-skills`. Always try to use **Firebase agent skills** for Firebase-related tasks.
2. Help me write, validate, and deploy Firebase Security Rules to protect my app's Cloud Storage data.
```

## Authentication

Knowing who your users are is an important part of building an application, and
Firebase Authentication provides an easy to use, secure, client side only solution
to authentication. Firebase Security Rules for Cloud Storage ties in to Firebase Authentication
for user based security. When a user is authenticated with Firebase Authentication,
the `request.auth` variable in Cloud Storage Security Rules becomes an object that
contains the user's unique ID (`request.auth.uid`) and all other user
information in the token (`request.auth.token`). When the user is not
authenticated, `request.auth` is `null`. This allows you to securely control
data access on a per-user basis. You can learn more in the
[Authentication](https://firebase.google.com/docs/storage/security/rules-conditions.md.txt#authentication) section.

## Authorization

Identifying your user is only part of security. Once you know who they are, you
need a way to control their access to files in Cloud Storage.

Cloud Storage lets you specify per file and per path authorization
rules that live on our servers and determine access to the files in your app.
For example, the default Cloud Storage Security Rules require Firebase Authentication in
order to perform any `read` or `write` operations on all files:

```
service firebase.storage {
  match /b/{bucket}/o {
    match /someFolder/{fileName} {
      allow read, write: if request.auth != null;
    }
  }
}
```

You can edit these Security Rules in the Firebase console by navigating to
the **Databases \& Storage** \> **Storage** \>
[**Rules** tab](https://console.firebase.google.com/project/_/storage/rules).

## Data Validation

Firebase Security Rules for Cloud Storage can also be used for data validation, including
validating file name and path as well as file metadata properties such as
`contentType` and `size`.

```
service firebase.storage {
  match /b/{bucket}/o {
    match /images/{imageId} {
      // Only allow uploads of any image file that's less than 5MB
      allow write: if request.resource.size < 5 * 1024 * 1024
                   && request.resource.contentType.matches('image/.*');
    }
  }
}
```

## Next steps

- [Get started](https://firebase.google.com/docs/storage/security/get-started.md.txt) planning rules development
  for your Cloud Storage buckets.

- Learn more about [securing your data](https://firebase.google.com/docs/storage/security/core-syntax.md.txt)
  using security rules.

## Defense in depth with VPC Service Controls

You can use
[VPC Service Controls](https://firebase.google.com/docs/storage/gcp-integration.md.txt#vpc-service-controls) to
protect your entire project with a security perimeter. This is a more
comprehensive alternative to the more granular access control that
Cloud Storage Security Rules provides.

Firebase Security Rules and VPC Service Controls work together:
Security Rules handle **authorization** (who can access which file),
while VPC Service Controls provide **network-level protection**
(preventing data from leaving your authorized environment). This layered
approach is a best practice for securing sensitive enterprise data.