Write Firebase Security Rules with AI Prompts

Share

TL;DR

These prompts help you write Firebase Security Rules for Firestore and Realtime Database. Without proper rules, anyone can read or write all your data. These prompts create rules that validate authentication, authorize access, and validate data integrity.

Firestore Security Rules

Basic Firestore Rules

Write Firestore security rules for my application.

Collections:

  • users (uid matches document ID)
  • posts (has authorId field)
  • comments (has postId and authorId fields)

Rules needed:

  1. Users can only read/write their own user document
  2. Anyone can read posts
  3. Only authenticated users can create posts
  4. Only the author can update/delete their posts
  5. Anyone can read comments on public posts
  6. Only authenticated users can create comments
  7. Only comment author can delete their comment

Include helper functions for common checks.

Realtime Database Rules

Realtime Database Rules

Write Firebase Realtime Database rules.

Structure: /users/{userId}/ /posts/{postId}/ /comments/{postId}/{commentId}/

Rules:

  1. Users can only access their own /users/{userId} data
  2. Posts are readable by anyone, writable by author only
  3. Comments can be read by anyone, written by authenticated users
  4. Validate that required fields exist on write

Include .validate rules for data integrity.

Data Validation Rules

Validation Rules

Add data validation to my Firebase security rules.

For Firestore posts collection, validate:

  1. title is a string, 1-100 characters
  2. content is a string, max 10000 characters
  3. authorId matches the authenticated user
  4. createdAt is a server timestamp
  5. status is one of: draft, published, archived
  6. tags is an array with max 5 items

The user should not be able to:

  • Set authorId to someone else's ID
  • Backdate createdAt
  • Set invalid status values

Generate complete rules with validation functions.

Default rules are dangerous: Firebase creates test mode rules that allow anyone to read/write everything. These expire after 30 days but you should replace them with proper rules immediately.

Role-Based Access

Role-Based Rules

Create Firebase rules with role-based access control.

Roles stored in /users/{userId}/role:

  • admin: full access
  • moderator: can read all, edit/delete any post
  • user: can only manage their own content

Collections: posts, comments, users, settings

Rules:

  1. Admin can do anything
  2. Moderator can read all users, edit any post/comment
  3. Users can only manage their own documents
  4. Settings collection is admin-only

Create helper functions to check roles efficiently.

Pro tip: Use the Firebase Rules Playground in the console to test your rules before deploying. You can simulate requests as different users to verify access is correct.

Why are my rules not working as expected?

Common issues: rules don't cascade (child rules can't override parent denials in RTDB), missing authentication checks, or wrong path structure. Use the Rules Playground to debug.

How do I allow access to some fields but not others?

In Firestore, you can't do field-level security directly. Instead, split sensitive data into a subcollection or separate document with stricter rules.

Check Your Firebase Rules

Scan your Firebase configuration for security issues.

Start Free Scan
AI Fix Prompts

Write Firebase Security Rules with AI Prompts