Menu
If I were to build a site without database interaction (no login on the site) with firebase. Do I need to change default security rules that looks like this:
{
"rules": {
".read": true,
".write": true
}
}
This red exclamation sign in the security & rules section says that I better write some security rules. So the question is, is it safe to leave this as is if you don't use login/signup ?
364
Edit and update your rulesOpen the Firebase console and select your project. Then, select Realtime Database, Cloud Firestore or Storage from the product navigation, then click Rules to navigate to the Rules editor. Edit your rules directly in the editor.
Any Firebase Realtime Database URL is accessible as a REST endpoint. All we need to do is append . json to the end of the URL and send a request from our favorite HTTPS client and we can access the data. It was confirmed that this Firebase Realtime Database URL is accessible without authentication.
Firebase Security Rules stand between your data and malicious users. You can write simple or complex rules that protect your app's data to the level of granularity that your specific app requires.
The RTDB has only three rule types: . read.
The thing is, FireBase has changed a lot. The new admin area has predefined security measures in place. So, you don't really have to worry about that anymore.
The default set of rules are
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}
And in case you want to open them up for both read and write permissions, you can roll back to
{
"rules": {
".read": true,
".write": true
}
}
With the default rule:
"rules": {
".read": true,
".write": true
}
everybody can read and can write your data using the Android,IOS and WEB SDKs.
You should provide a kind of authentication with a Token or with Email/Password authentication.
"rules": {
".read": "auth !== null",
".write": "auth !== null",
}
Pay attention because your rules don't effect what you can or can't do in the Firebase dashboard. Anyone with access to the dashboard, including collaborators who you share your Firebase dashboard with, can circumvent the rules.
More info here.
22
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
