Styjun

is it possible to change a material depending on whether it is intersecting with another object?

Is there any control character or hack to prevent simple command line tools from showing subsequent data?

How do we create our own symbolisms?

Why does low tire pressure decrease fuel economy?

Leaving the USA for 10 yrs when you have asylum

Why did Tony's Arc Reactor do this?

How would two worlds first establish an exchange rate between their currencies

Why would an AC motor heavily shake when driven with certain frequencies?

Is there a specific way to describe over-grown, old, tough vegetables?

Strategies for dealing with chess burnout?

How to handle fsck "Error while scanning inodes"?

What happens when a file that is 100% paged in to the page cache gets modified by another process

The pirate treasure of Leatherback Atoll

A question regarding Buddhist world view and sense organs and their objects

Who is the uncredited actor leading the squad in the Valerian movie?

The Green Glass Door, Revisited

Problem with listing a directory to grep

Did "Dirty Harry" feel lucky?

Is there a "right" way to interpret a novel, if not, how do we make sure our novel is interpreted correctly?

2 load centers under 1 meter: do you need bonding and main breakers at both?

Can multiple public keys lead to the same shared secret in x25519?

When does order matter in probability?

Stack class in Java8

Supervisor wants me to support a diploma-thesis software tool after I graduated

How do I securely limit users to only list documents that they've created?

Securing specific Document fields in FirestoreFirebase Rules for Cloud Firestore to limit maximum number of documentsGrant read permission to only document creatorFirestore - security rules for users within companiesFirestore Security Rules - Allow Public Create AccessFirestore Rules multi organization multi user access rights listing dataFirebase Rule - Match document to user via email addressAn issue with preventing users from changing specific document fields in FirestoreHow to query Firestore collection for documents with field whose value is contained in a list

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

0

I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do

db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)

.. but any tech savvy user could just remove the filter and get everything.

I've limited access in rules like

match /projects/project 
 allow read,update: if request.auth.uid == resource.data.user;
 allow create;

But this doesn't work, you can't list at all.

Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
  
  – Doug Stevenson
  Mar 28 at 15:41
  
  

  
  
  
  

add a comment | 

0

I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do

db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)

.. but any tech savvy user could just remove the filter and get everything.

I've limited access in rules like

match /projects/project 
 allow read,update: if request.auth.uid == resource.data.user;
 allow create;

But this doesn't work, you can't list at all.

Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
  
  – Doug Stevenson
  Mar 28 at 15:41
  
  

  
  
  
  

add a comment | 

I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do

db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)

.. but any tech savvy user could just remove the filter and get everything.

I've limited access in rules like

match /projects/project 
 allow read,update: if request.auth.uid == resource.data.user;
 allow create;

But this doesn't work, you can't list at all.

Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.

firebase google-cloud-firestore firebase-security-rules

share|improve this question

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)

match /projects/project 
 allow read,update: if request.auth.uid == resource.data.user;
 allow create;

share|improve this question

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

share|improve this question

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

edited Mar 28 at 15:39

Doug Stevenson

108k1212 gold badges126126 silver badges152152 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

asked Mar 28 at 7:28

awfullyawfulawfullyawful

1122 bronze badges

1 Answer
1

active

oldest

votes

0

Assuming you stored the user_id in the field "user" in firestore. You can use

 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
 db.collection("projects").whereEqualTo("user", uid)...

After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.

share|improve this answer

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
  
  – awfullyawful
  Mar 28 at 11:14
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
  
  – bensadiku
  Mar 28 at 11:24
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
  
  – awfullyawful
  Mar 28 at 22:22
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Nice! I'm glad you got it fixed. :)
  
  – bensadiku
  Mar 28 at 22:23
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55392206%2fhow-do-i-securely-limit-users-to-only-list-documents-that-theyve-created%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

Assuming you stored the user_id in the field "user" in firestore. You can use

 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
 db.collection("projects").whereEqualTo("user", uid)...

After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.

share|improve this answer

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
  
  – awfullyawful
  Mar 28 at 11:14
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
  
  – bensadiku
  Mar 28 at 11:24
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
  
  – awfullyawful
  Mar 28 at 22:22
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Nice! I'm glad you got it fixed. :)
  
  – bensadiku
  Mar 28 at 22:23
  

  
  
  
  

add a comment | 

0

Assuming you stored the user_id in the field "user" in firestore. You can use

 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
 db.collection("projects").whereEqualTo("user", uid)...

After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.

share|improve this answer

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
  
  – awfullyawful
  Mar 28 at 11:14
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
  
  – bensadiku
  Mar 28 at 11:24
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
  
  – awfullyawful
  Mar 28 at 22:22
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Nice! I'm glad you got it fixed. :)
  
  – bensadiku
  Mar 28 at 22:23
  

  
  
  
  

add a comment | 

Assuming you stored the user_id in the field "user" in firestore. You can use

 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
 db.collection("projects").whereEqualTo("user", uid)...

After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.

share|improve this answer

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
 db.collection("projects").whereEqualTo("user", uid)...

share|improve this answer

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges

answered Mar 28 at 11:08

bensadikubensadiku

33311 silver badge1010 bronze badges