时间戳

首页 > 解决方案 > firebase rules write for auth user but delete only its own data

firebase - firebase rules write for auth user but delete only its own data

问题描述

is there a way to let users only delete their own data? auth users can write to FB and read other users data but only can delete theis own data.

could it be that write rule includes the delete rule?

like:

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read; 
      allow delete: if request.auth.uid == resource.data.userid;
      allow write: if request.auth.uid != null;
    }
  }
}

标签： firebasefirebase-authenticationgoogle-cloud-firestorefirebase-security

解决方案

写权限确实包括删除。这在文档中有所说明。

读取规则可以分为 get 和 list，而写入规则可以分为 create、update 和 delete

因此，如果您授予写访问权限，您将隐式授予创建、更新和删除权限。您可能希望将它们分开：

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read; 
      allow delete: if request.auth.uid == resource.data.userid;
      allow create, update: if request.auth.uid != null;
    }
  }
}

推荐阅读