TL;DR
These prompts help you write Firebase Security Rules for Firestore and Realtime Database. Without proper rules, anyone can read or write all your data. These prompts create rules that validate authentication, authorize access, and validate data integrity.
Firestore Security Rules
Write Firestore security rules for my application.
Collections:
- users (uid matches document ID)
- posts (has authorId field)
- comments (has postId and authorId fields)
Rules needed:
- Users can only read/write their own user document
- Anyone can read posts
- Only authenticated users can create posts
- Only the author can update/delete their posts
- Anyone can read comments on public posts
- Only authenticated users can create comments
- Only comment author can delete their comment
Include helper functions for common checks.
Realtime Database Rules
Write Firebase Realtime Database rules.
Structure: /users/{userId}/ /posts/{postId}/ /comments/{postId}/{commentId}/
Rules:
- Users can only access their own /users/{userId} data
- Posts are readable by anyone, writable by author only
- Comments can be read by anyone, written by authenticated users
- Validate that required fields exist on write
Include .validate rules for data integrity.
Data Validation Rules
Add data validation to my Firebase security rules.
For Firestore posts collection, validate:
- title is a string, 1-100 characters
- content is a string, max 10000 characters
- authorId matches the authenticated user
- createdAt is a server timestamp
- status is one of: draft, published, archived
- tags is an array with max 5 items
The user should not be able to:
- Set authorId to someone else's ID
- Backdate createdAt
- Set invalid status values
Generate complete rules with validation functions.
Default rules are dangerous: Firebase creates test mode rules that allow anyone to read/write everything. These expire after 30 days but you should replace them with proper rules immediately.
Role-Based Access
Create Firebase rules with role-based access control.
Roles stored in /users/{userId}/role:
- admin: full access
- moderator: can read all, edit/delete any post
- user: can only manage their own content
Collections: posts, comments, users, settings
Rules:
- Admin can do anything
- Moderator can read all users, edit any post/comment
- Users can only manage their own documents
- Settings collection is admin-only
Create helper functions to check roles efficiently.
Pro tip: Use the Firebase Rules Playground in the console to test your rules before deploying. You can simulate requests as different users to verify access is correct.
Why are my rules not working as expected?
Common issues: rules don't cascade (child rules can't override parent denials in RTDB), missing authentication checks, or wrong path structure. Use the Rules Playground to debug.
How do I allow access to some fields but not others?
In Firestore, you can't do field-level security directly. Instead, split sensitive data into a subcollection or separate document with stricter rules.