How do I securely limit users to only list documents that they've created?Securing specific Document fields in FirestoreFirebase Rules for Cloud Firestore to limit maximum number of documentsGrant read permission to only document creatorFirestore - security rules for users within companiesFirestore Security Rules - Allow Public Create AccessFirestore Rules multi organization multi user access rights listing dataFirebase Rule - Match document to user via email addressAn issue with preventing users from changing specific document fields in FirestoreHow to query Firestore collection for documents with field whose value is contained in a list
is it possible to change a material depending on whether it is intersecting with another object?
Is there any control character or hack to prevent simple command line tools from showing subsequent data?
How do we create our own symbolisms?
Why does low tire pressure decrease fuel economy?
Leaving the USA for 10 yrs when you have asylum
Why did Tony's Arc Reactor do this?
How would two worlds first establish an exchange rate between their currencies
Why would an AC motor heavily shake when driven with certain frequencies?
Is there a specific way to describe over-grown, old, tough vegetables?
Strategies for dealing with chess burnout?
How to handle fsck "Error while scanning inodes"?
What happens when a file that is 100% paged in to the page cache gets modified by another process
The pirate treasure of Leatherback Atoll
A question regarding Buddhist world view and sense organs and their objects
Who is the uncredited actor leading the squad in the Valerian movie?
The Green Glass Door, Revisited
Problem with listing a directory to grep
Did "Dirty Harry" feel lucky?
Is there a "right" way to interpret a novel, if not, how do we make sure our novel is interpreted correctly?
2 load centers under 1 meter: do you need bonding and main breakers at both?
Can multiple public keys lead to the same shared secret in x25519?
When does order matter in probability?
Stack class in Java8
Supervisor wants me to support a diploma-thesis software tool after I graduated
How do I securely limit users to only list documents that they've created?
Securing specific Document fields in FirestoreFirebase Rules for Cloud Firestore to limit maximum number of documentsGrant read permission to only document creatorFirestore - security rules for users within companiesFirestore Security Rules - Allow Public Create AccessFirestore Rules multi organization multi user access rights listing dataFirebase Rule - Match document to user via email addressAn issue with preventing users from changing specific document fields in FirestoreHow to query Firestore collection for documents with field whose value is contained in a list
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do
db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)
.. but any tech savvy user could just remove the filter and get everything.
I've limited access in rules like
match /projects/project
allow read,update: if request.auth.uid == resource.data.user;
allow create;
But this doesn't work, you can't list at all.
Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.
firebase google-cloud-firestore firebase-security-rules
add a comment |
I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do
db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)
.. but any tech savvy user could just remove the filter and get everything.
I've limited access in rules like
match /projects/project
allow read,update: if request.auth.uid == resource.data.user;
allow create;
But this doesn't work, you can't list at all.
Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.
firebase google-cloud-firestore firebase-security-rules
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41
add a comment |
I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do
db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)
.. but any tech savvy user could just remove the filter and get everything.
I've limited access in rules like
match /projects/project
allow read,update: if request.auth.uid == resource.data.user;
allow create;
But this doesn't work, you can't list at all.
Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.
firebase google-cloud-firestore firebase-security-rules
I want to be able to limit users to only list documents they've created.
The user id is stored in the user field
Obviously I can do
db.collection('projects').where('user', '==', firebase.auth().currentUser.uid)
.. but any tech savvy user could just remove the filter and get everything.
I've limited access in rules like
match /projects/project
allow read,update: if request.auth.uid == resource.data.user;
allow create;
But this doesn't work, you can't list at all.
Is there a way of doing this without creating a subcollection of the user's entry in the user collection? I'd really prefer to have them all in one place.
Surely this is an extremely common scenario.
firebase google-cloud-firestore firebase-security-rules
firebase google-cloud-firestore firebase-security-rules
edited Mar 28 at 15:39
Doug Stevenson
108k12 gold badges126 silver badges152 bronze badges
108k12 gold badges126 silver badges152 bronze badges
asked Mar 28 at 7:28
awfullyawfulawfullyawful
112 bronze badges
112 bronze badges
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41
add a comment |
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41
add a comment |
1 Answer
1
active
oldest
votes
Assuming you stored the user_id in the field "user" in firestore. You can use
String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...
After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55392206%2fhow-do-i-securely-limit-users-to-only-list-documents-that-theyve-created%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Assuming you stored the user_id in the field "user" in firestore. You can use
String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...
After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
add a comment |
Assuming you stored the user_id in the field "user" in firestore. You can use
String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...
After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
add a comment |
Assuming you stored the user_id in the field "user" in firestore. You can use
String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...
After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.
Assuming you stored the user_id in the field "user" in firestore. You can use
String uid = FirebaseAuth.getInstance().getCurrentUser().getUid();
db.collection("projects").whereEqualTo("user", uid)...
After ellipses you can use .get() with onSuccesss or onComplete or add Snapshot listener.
answered Mar 28 at 11:08
bensadikubensadiku
3331 silver badge10 bronze badges
3331 silver badge10 bronze badges
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
add a comment |
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
Right, but that's an artificial limit as they can easily bypass it by doing a manual query without the filter. I want the filter to be enforced server side if possible. I guess I'll just have to make a cloud function but then I don't get the benefits of live updates
– awfullyawful
Mar 28 at 11:14
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
What do you mean you don't get "benefits of live updates"? You can add Snapshot listener to almost everything
– bensadiku
Mar 28 at 11:24
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Facepalm... I found the solution to my problem at firebase.google.com/docs/firestore/security/rules-query I actually thought I did it like that and it wasn't working, it is now - obviously did something wrong the first time
– awfullyawful
Mar 28 at 22:22
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
Nice! I'm glad you got it fixed. :)
– bensadiku
Mar 28 at 22:23
add a comment |
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55392206%2fhow-do-i-securely-limit-users-to-only-list-documents-that-theyve-created%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I would expect your rule to work with the query you're showing. What exactly happens with that query? If the rule rejects the query, you would expect to see an error. Do you?
– Doug Stevenson
Mar 28 at 15:41