Write Firebase Security Rules with AI Prompts

TL;DR

These prompts help you write Firebase Security Rules for Firestore and Realtime Database. Without proper rules, anyone can read or write all your data. These prompts create rules that validate authentication, authorize access, and validate data integrity.

Firestore Security Rules

Copy this prompt to generate Firestore security rules for users, posts, and comments collections. Your AI will produce complete rules with ownership checks, auth requirements, and reusable helper functions.

AI Prompt

Basic Firestore Rules

Write Firestore security rules for my application.

Collections:

  • users (uid matches document ID)
  • posts (has authorId field)
  • comments (has postId and authorId fields)

Rules needed:

  1. Users can only read/write their own user document
  2. Anyone can read posts
  3. Only authenticated users can create posts
  4. Only the author can update/delete their posts
  5. Anyone can read comments on public posts
  6. Only authenticated users can create comments
  7. Only comment author can delete their comment

Include helper functions for common checks.

Realtime Database Rules

Use this prompt to generate Firebase Realtime Database rules with proper read/write restrictions and .validate rules for data integrity across your users, posts, and comments paths.

AI Prompt

Realtime Database Rules

Write Firebase Realtime Database rules.

Structure: /users/{userId}/ /posts/{postId}/ /comments/{postId}/{commentId}/

Rules:

  1. Users can only access their own /users/{userId} data
  2. Posts are readable by anyone, writable by author only
  3. Comments can be read by anyone, written by authenticated users
  4. Validate that required fields exist on write

Include .validate rules for data integrity.

Data Validation Rules

Paste this prompt to add field-level validation to your Firestore rules. Your AI will generate rules that enforce string lengths, server timestamps, enum values, array limits, and prevent users from spoofing author IDs or backdating records.

AI Prompt

Validation Rules

Add data validation to my Firebase security rules.

For Firestore posts collection, validate:

  1. title is a string, 1-100 characters
  2. content is a string, max 10000 characters
  3. authorId matches the authenticated user
  4. createdAt is a server timestamp
  5. status is one of: draft, published, archived
  6. tags is an array with max 5 items

The user should not be able to:

  • Set authorId to someone else's ID
  • Backdate createdAt
  • Set invalid status values

Generate complete rules with validation functions.

Default rules are dangerous: Firebase creates test mode rules that allow anyone to read/write everything. These expire after 30 days but you should replace them with proper rules immediately.

Role-Based Access

This prompt asks your AI to create Firebase rules with admin, moderator, and user roles. You'll get helper functions for efficient role checking and collection-level access control for posts, comments, users, and settings.

AI Prompt

Role-Based Rules

Create Firebase rules with role-based access control.

Roles stored in /users/{userId}/role:

  • admin: full access
  • moderator: can read all, edit/delete any post
  • user: can only manage their own content

Collections: posts, comments, users, settings

Rules:

  1. Admin can do anything
  2. Moderator can read all users, edit any post/comment
  3. Users can only manage their own documents
  4. Settings collection is admin-only

Create helper functions to check roles efficiently.

Pro tip: Use the Firebase Rules Playground in the console to test your rules before deploying. You can simulate requests as different users to verify access is correct.

Why are my rules not working as expected?

Common issues: rules don't cascade (child rules can't override parent denials in RTDB), missing authentication checks, or wrong path structure. Use the Rules Playground to debug.

How do I allow access to some fields but not others?

In Firestore, you can't do field-level security directly. Instead, split sensitive data into a subcollection or separate document with stricter rules.

Further Reading

Want to understand the vulnerability before fixing it? These guides explain what's happening and why.

Check Your Firebase Rules

Scan your Firebase configuration for security issues.

AI Fix Prompts

Write Firebase Security Rules with AI Prompts