如何保护我的 Firestore 数据库免受不必要的访问？

Question

I am using Firebase Firestore to store a list of transactions in a collection called transactions .

I use react to get the transaction from the collection, using a URL with the id of the transaction document: http://myurl.com/h1kj54h2jk35h

const id = match.params.id;
firebase.firestore().collection('transactions').doc(id).get()

The same way I create a new doc. I have not firebase authentication.

How can I secure my Firestore rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /transactions/{id} {
      allow read, write;
    }
  }
}

If I don't allow write, I can't create new transactions. If I don't allow read, I can't read the transaction, but I don't want to allow the read of all transactions. Only the once when the id from the URL is valid.

Thus, I am looking for a way to protect my database agains unwanted document creations and unwanted document reads.

Answer 1

I think you're looking for what are called granular operations . From that link:

In some situations, it's useful to break down read and write into more granular operations. For example, your app may want to enforce different conditions on document creation than on document deletion. Or you may want to allow single document reads but deny large queries.

A read rule can be broken into get and list , while a write rule can be broken into create , update , and delete .

So if you want to only allow creation of new documents, and getting of document for which a user must know the ID, that'd be:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /transactions/{id} {
      allow create, get;
    }
  }
}