How do I securely limit users to only list documents that they've created?Securing specific Document fields in FirestoreFirebase Rules for Cloud Firestore to limit maximum number of documentsGrant read permission to only document creatorFirestore - security rules for users within companiesFirestore Security Rules - Allow Public Create AccessFirestore Rules multi organization multi user access rights listing dataFirebase Rule - Match document to user via email addressAn issue with preventing users from changing specific document fields in FirestoreHow to query Firestore collection for documents with field whose value is contained in a list

is it possible to change a material depending on whether it is intersecting with another object?

Is there any control character or hack to prevent simple command line tools from showing subsequent data?

How do we create our own symbolisms?

Why does low tire pressure decrease fuel economy?

Leaving the USA for 10 yrs when you have asylum

Why did Tony's Arc Reactor do this?

How would two worlds first establish an exchange rate between their currencies

Why would an AC motor heavily shake when driven with certain frequencies?

Is there a specific way to describe over-grown, old, tough vegetables?

Strategies for dealing with chess burnout?

How to handle fsck "Error while scanning inodes"?

What happens when a file that is 100% paged in to the page cache gets modified by another process

The pirate treasure of Leatherback Atoll

A question regarding Buddhist world view and sense organs and their objects

Who is the uncredited actor leading the squad in the Valerian movie?

The Green Glass Door, Revisited

Problem with listing a directory to grep

Did "Dirty Harry" feel lucky?

Is there a "right" way to interpret a novel, if not, how do we make sure our novel is interpreted correctly?

2 load centers under 1 meter: do you need bonding and main breakers at both?

Can multiple public keys lead to the same shared secret in x25519?

When does order matter in probability?

Stack class in Java8

Supervisor wants me to support a diploma-thesis software tool after I graduated



How do I securely limit users to only list documents that they've created?


Securing specific Document fields in FirestoreFirebase Rules for Cloud Firestore to limit maximum number of documentsGrant read permission to only document creatorFirestore - security rules for users within companiesFirestore Security Rules - Allow Public Create AccessFirestore Rules multi organization multi user access rights listing dataFirebase Rule - Match document to user via email addressAn issue with preventing users from changing specific document fields in FirestoreHow to query Firestore collection for documents with field whose value is contained in a list






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;








0















I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do



db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)


.. but any tech savvy user could just remove the filter and get everything.



I've limited access in rules like



match /projects/project 
allow read,update: if request.auth.uid == resource.data.user;
allow create;



But this doesn't work, you can't list at all.



Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.










share|improve this question


























  • I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

    – Doug Stevenson
    Mar 28 at 15:41


















0















I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do



db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)


.. but any tech savvy user could just remove the filter and get everything.



I've limited access in rules like



match /projects/project 
allow read,update: if request.auth.uid == resource.data.user;
allow create;



But this doesn't work, you can't list at all.



Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.










share|improve this question


























  • I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

    – Doug Stevenson
    Mar 28 at 15:41














0












0








0








I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do



db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)


.. but any tech savvy user could just remove the filter and get everything.



I've limited access in rules like



match /projects/project 
allow read,update: if request.auth.uid == resource.data.user;
allow create;



But this doesn't work, you can't list at all.



Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.










share|improve this question
















I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do



db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)


.. but any tech savvy user could just remove the filter and get everything.



I've limited access in rules like



match /projects/project 
allow read,update: if request.auth.uid == resource.data.user;
allow create;



But this doesn't work, you can't list at all.



Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.







firebase google-cloud-firestore firebase-security-rules






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Mar 28 at 15:39









Doug Stevenson

108k12 gold badges126 silver badges152 bronze badges




108k12 gold badges126 silver badges152 bronze badges










asked Mar 28 at 7:28









awfullyawfulawfullyawful

112 bronze badges




112 bronze badges















  • I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

    – Doug Stevenson
    Mar 28 at 15:41


















  • I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

    – Doug Stevenson
    Mar 28 at 15:41

















I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

– Doug Stevenson
Mar 28 at 15:41






I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?

– Doug Stevenson
Mar 28 at 15:41













1 Answer
1






active

oldest

votes


















0
















Assuming you stored the user_id in the field "user" in firestore. You can use



 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...


After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.






share|improve this answer

























  • Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

    – awfullyawful
    Mar 28 at 11:14











  • What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

    – bensadiku
    Mar 28 at 11:24












  • Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

    – awfullyawful
    Mar 28 at 22:22












  • Nice! I'm glad you got it fixed. :)

    – bensadiku
    Mar 28 at 22:23










Your Answer






StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);














draft saved

draft discarded
















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55392206%2fhow-do-i-securely-limit-users-to-only-list-documents-that-theyve-created%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









0
















Assuming you stored the user_id in the field "user" in firestore. You can use



 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...


After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.






share|improve this answer

























  • Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

    – awfullyawful
    Mar 28 at 11:14











  • What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

    – bensadiku
    Mar 28 at 11:24












  • Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

    – awfullyawful
    Mar 28 at 22:22












  • Nice! I'm glad you got it fixed. :)

    – bensadiku
    Mar 28 at 22:23















0
















Assuming you stored the user_id in the field "user" in firestore. You can use



 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...


After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.






share|improve this answer

























  • Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

    – awfullyawful
    Mar 28 at 11:14











  • What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

    – bensadiku
    Mar 28 at 11:24












  • Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

    – awfullyawful
    Mar 28 at 22:22












  • Nice! I'm glad you got it fixed. :)

    – bensadiku
    Mar 28 at 22:23













0














0










0









Assuming you stored the user_id in the field "user" in firestore. You can use



 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...


After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.






share|improve this answer













Assuming you stored the user_id in the field "user" in firestore. You can use



 String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...


After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.







share|improve this answer












share|improve this answer



share|improve this answer










answered Mar 28 at 11:08









bensadikubensadiku

3331 silver badge10 bronze badges




3331 silver badge10 bronze badges















  • Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

    – awfullyawful
    Mar 28 at 11:14











  • What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

    – bensadiku
    Mar 28 at 11:24












  • Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

    – awfullyawful
    Mar 28 at 22:22












  • Nice! I'm glad you got it fixed. :)

    – bensadiku
    Mar 28 at 22:23

















  • Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

    – awfullyawful
    Mar 28 at 11:14











  • What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

    – bensadiku
    Mar 28 at 11:24












  • Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

    – awfullyawful
    Mar 28 at 22:22












  • Nice! I'm glad you got it fixed. :)

    – bensadiku
    Mar 28 at 22:23
















Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

– awfullyawful
Mar 28 at 11:14





Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates

– awfullyawful
Mar 28 at 11:14













What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

– bensadiku
Mar 28 at 11:24






What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything

– bensadiku
Mar 28 at 11:24














Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

– awfullyawful
Mar 28 at 22:22






Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time

– awfullyawful
Mar 28 at 22:22














Nice! I'm glad you got it fixed. :)

– bensadiku
Mar 28 at 22:23





Nice! I'm glad you got it fixed. :)

– bensadiku
Mar 28 at 22:23








Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.







Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.




















draft saved

draft discarded















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55392206%2fhow-do-i-securely-limit-users-to-only-list-documents-that-theyve-created%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Kamusi Yaliyomo Aina za kamusi | Muundo wa kamusi | Faida za kamusi | Dhima ya picha katika kamusi | Marejeo | Tazama pia | Viungo vya nje | UrambazajiKuhusu kamusiGo-SwahiliWiki-KamusiKamusi ya Kiswahili na Kiingerezakuihariri na kuongeza habari

SQL error code 1064 with creating Laravel foreign keysForeign key constraints: When to use ON UPDATE and ON DELETEDropping column with foreign key Laravel error: General error: 1025 Error on renameLaravel SQL Can't create tableLaravel Migration foreign key errorLaravel php artisan migrate:refresh giving a syntax errorSQLSTATE[42S01]: Base table or view already exists or Base table or view already exists: 1050 Tableerror in migrating laravel file to xampp serverSyntax error or access violation: 1064:syntax to use near 'unsigned not null, modelName varchar(191) not null, title varchar(191) not nLaravel cannot create new table field in mysqlLaravel 5.7:Last migration creates table but is not registered in the migration table

은진 송씨 목차 역사 본관 분파 인물 조선 왕실과의 인척 관계 집성촌 항렬자 인구 같이 보기 각주 둘러보기 메뉴은진 송씨세종실록 149권, 지리지 충청도 공주목 은진현