How to setup security rules for a Flutter app that uses Cloud Firestore?

Question

I am creating a Flutter mobile app and want to use Cloud Firestore to store some data that the clients should access. So far, there is no user-specific data, so I don't want my users to have to login in the app. What security rules do I need to specify to allow clients to read data, but deny public access (from "outside" of the app)?

These are the security rules I have setup so far.

service cloud.firestore {
    match /databases/{database}/documents {
        match /{document=**} {
            allow write: if false;
            allow read: if request.auth.uid != null;
        }
    }
}

Under Authentication --> Sign-in method, I have enabled anonymous authentication. But I'm not sure if the security rules are correct and what Dart code I need in the client to get the desired behavior (no need for client to specify credentials, but protection of my data from access outside of the app).

So you say "so I don't want my users to have to login in the app" and in the same time you say "What security rules do I need to specify to allow clients to login". So there is a misunderstanding. — Alex Mamo
– Alex Mamo, Commented Dec 28, 2018 at 11:28
Sorry, I edited the question. I don't want my users to login manually, but I'm not sure if I have to do something on the client side to authenticate the client (automatically, without the user noticing). — Maetthu24
– Maetthu24, Commented Dec 28, 2018 at 11:33

Alex Mamo · Accepted Answer · 2018-12-28 11:45:37Z

3

so I don't want my users to have to login in the app.

But you authenticate them. Even if it's an anonymous authentication, it's still an authentication.

What security rules do I need to specify to allow clients to read data, but deny public access (from "outside" of the app)?

The exact rules you already have.

But I'm not sure if the security rules are correct.

The rules are correct.

what Dart code I need in the client to get the desired behavior (no need for client to specify credentials, but protection of my data from access outside of the app).

Your code should look similar to this.

answered Dec 28, 2018 at 11:45

Alex Mamo

139k18 gold badges171 silver badges202 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Maetthu24 Over a year ago

Ok thank you, so just to clarify: This will create a new, anonymous user for every client session, right? Seems kind of weird but if that's the way to go...

Alex Mamo Over a year ago

A single user will only have a single "session". Every user will have his own "session". Please also see my answer from this post.

Collectives™ on Stack Overflow

How to setup security rules for a Flutter app that uses Cloud Firestore?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related