如何在 Web 应用程序的 FireStore 中传递 Auth 令牌

Question

I have developed a single crud project(Login screen and crud operation screen HTML) and hosted on firebase hosting. where User signing with email and password, I am using firebase signing with email and password and its working as expected.

But now issue is I want to secure backend with auth but its not passing auth in setDoc() deleteDoc() etc, My requirement is without auth. no one should do any operation on database.

import { doc, setDoc } from "firebase/firestore"; 
await setDoc(doc(db, "cities", "LA"), {
  name: "Los Angeles",
  state: "CA",
  country: "USA"
});

below rules are working but its not secured for production env. :

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true
    }
  }
}

If set rules like below it give me insufficient permission error. I don't know how to pass UID in setDoc() or any operation.

allow read, write: if request.auth != null

Update: If i put below code before setDoc() below code is not executing because currentUser has user data.

function addCity(){

    if (!firebase.auth().currentUser) {
        // this code not executing because user is signed
        alert("Login required");
        window.href = "login.html";
        return;
    }
    // i can print UID and it is showing means user is logged.
    await setDoc(doc(db, "cities", "LA"), {
         name: "Los Angeles",
         state: "CA",
         country: "USA"
    });
}

Answer 1

This is in detail covered in the Firebase documentation on Security & Rules , which I would recommend you to check out.You can secure your data with Security Rules,Firebase Security Rules are evaluated and based on that the rules language it is validated whether the current user can access your data.
Security Rules give you access to a set of server variables to check your rules against. The most commonly used one is the auth variable which lets you check against the currently authenticated user. You can also create wildcard variables with the $, which acts as a route parameter creating.
{ "rules": { "users": { // users can read and write their own data, but no one else. "$uid": { ".read": "auth.uid == $uid", ".write": "auth.uid == $uid" } } } }

You can also check the feature called Firebase App Check , it will let you limit access to your Realtime Database to only those coming from iOS, Android and Web apps that are registered in your Firebase project. You can combine this with the user authentication based security described above, so that you have another shield. Also check these similar examples below:

• How to prevent unauthorized access to Firebase database
• How to prevent users from changing the Database data
• Allow only authenticated users to modify database data

Answer 2

Finally, I found solution. I was using different version library of firebase. like I was using web v8 library for login and modular lib for database access. I just moved all firebase SDK to same version and modular.