TL;DR
These prompts help you write Firebase Security Rules for Firestore and Realtime Database. Without proper rules, anyone can read or write all your data. These prompts create rules that validate authentication, authorize access, and validate data integrity.
Firestore Security Rules
Copy this prompt to generate Firestore security rules for users, posts, and comments collections. Your AI will produce complete rules with ownership checks, auth requirements, and reusable helper functions.
Basic Firestore Rules
Write Firestore security rules for my application.
Collections:
- users (uid matches document ID)
- posts (has authorId field)
- comments (has postId and authorId fields)
Rules needed:
- Users can only read/write their own user document
- Anyone can read posts
- Only authenticated users can create posts
- Only the author can update/delete their posts
- Anyone can read comments on public posts
- Only authenticated users can create comments
- Only comment author can delete their comment
Include helper functions for common checks.
Realtime Database Rules
Use this prompt to generate Firebase Realtime Database rules with proper read/write restrictions and .validate rules for data integrity across your users, posts, and comments paths.
Realtime Database Rules
Write Firebase Realtime Database rules.
Structure: /users/{userId}/ /posts/{postId}/ /comments/{postId}/{commentId}/
Rules:
- Users can only access their own /users/{userId} data
- Posts are readable by anyone, writable by author only
- Comments can be read by anyone, written by authenticated users
- Validate that required fields exist on write
Include .validate rules for data integrity.
Data Validation Rules
Paste this prompt to add field-level validation to your Firestore rules. Your AI will generate rules that enforce string lengths, server timestamps, enum values, array limits, and prevent users from spoofing author IDs or backdating records.
Validation Rules
Add data validation to my Firebase security rules.
For Firestore posts collection, validate:
- title is a string, 1-100 characters
- content is a string, max 10000 characters
- authorId matches the authenticated user
- createdAt is a server timestamp
- status is one of: draft, published, archived
- tags is an array with max 5 items
The user should not be able to:
- Set authorId to someone else's ID
- Backdate createdAt
- Set invalid status values
Generate complete rules with validation functions.
Default rules are dangerous: Firebase creates test mode rules that allow anyone to read/write everything. These expire after 30 days but you should replace them with proper rules immediately.
Role-Based Access
This prompt asks your AI to create Firebase rules with admin, moderator, and user roles. You'll get helper functions for efficient role checking and collection-level access control for posts, comments, users, and settings.
Role-Based Rules
Create Firebase rules with role-based access control.
Roles stored in /users/{userId}/role:
- admin: full access
- moderator: can read all, edit/delete any post
- user: can only manage their own content
Collections: posts, comments, users, settings
Rules:
- Admin can do anything
- Moderator can read all users, edit any post/comment
- Users can only manage their own documents
- Settings collection is admin-only
Create helper functions to check roles efficiently.
Pro tip: Use the Firebase Rules Playground in the console to test your rules before deploying. You can simulate requests as different users to verify access is correct.
Why are my rules not working as expected?
Common issues: rules don't cascade (child rules can't override parent denials in RTDB), missing authentication checks, or wrong path structure. Use the Rules Playground to debug.
How do I allow access to some fields but not others?
In Firestore, you can't do field-level security directly. Instead, split sensitive data into a subcollection or separate document with stricter rules.
Further Reading
Want to understand the vulnerability before fixing it? These guides explain what's happening and why.
Check Your Firebase Rules
Scan your Firebase configuration for security issues.