firebase - 任何人都可以帮我编辑亚马逊等电子商务应用的 Firebase 规则吗

Question

谁能帮我编辑电子商务应用程序的firebase规则，因为我收到来自firebase的邮件说你的firebase规则不安全。我需要它们用于firebase firestore。

标签： firebasegoogle-cloud-firestorefirebase-security

Answer 1

仅用于开发，您可以使用它。不用于生产

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
      // EVERYUSER CAN EDIT AND DELETE YOUR DATA. NOT FOR PRODUCTION.
    }
  }
}

当您了解 Firestore 规则的工作原理时，这应该会为您提供指导。

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isLoggedIn() {
      return request.auth != null;
    }
    function isOwner() {
      // where ownerId is the id of the owner
      return isLoggedIn() && resource != null && (resource.data.ownerId == request.auth.uid);
    }

    match /posts/{postId} {
      // for an ecommerce app, 
      // everybody should be able to view posts
      allow read: if true;
      // only logged in users should be able to create posts
      allow create: if isLoggedIn();
      // only the owner of a post should be able to edit/delete posts
      allow update, delete: if isOwner();
    }
    match /users/{userId} {
      // You should be able to get, edit and delete only your data
      allow get, write: if isOwner();
      // no body should be able to get list of your users
      allow list: if false;
    }
  }
}