我已经创建了防火墙和颤音应用程序,谷歌( google )正在给我发电子邮件,称防火墙规则不太好。我怎样才能使这些规则更好?我想授予登录用户读取权限和帐户读取和写入权限。
发布于 2022-06-04 17:23:00
我希望这会对你有帮助。
service cloud.firestore {
match /databases/{database}/documents {
// Make sure the uid of the requesting user matches name of the user
// document. The wildcard expression {userId} makes the userId variable
// available in rules.
match /users/{userId} {
allow read, update, delete: if request.auth != null && request.auth.uid == userId;
allow create: if request.auth != null;
}
}
}发布于 2022-06-04 19:30:16
这是确保数据库安全的正确方法。
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// Line below secure whole database so users are not alowed to create any new collections etc.
match /{document=**} {
allow read, write: if false;
}
match /app/{dataId} {
allow read: if true;
allow write: if isAdmin();
}
match /posts/{dataId} {
allow read: if resource.data.isPublic == true || isAdmin();
allow write: if isAdmin();
}
}
}
function isAdmin() {
return request.auth.token.admin == true;
}用户没有任何.admin变量。您必须使用firebase函数来分配它们。阅读有关自定义索赔的文章。
https://stackoverflow.com/questions/72501300
复制相似问题