如果我使用服务器端，是否需要 firebase 规则？

Question

Do I need to modify the code in firebase rules if I'm using server-side using nodejs

I set the rules as follows:

allow read, write: if true;

is there any problem? Note that I do not use firebase on the client side

Answer 1

Backend code using the server/admin SDKs that are initialized with a service account always bypasses security rules completely, as if they don't exist. Rules only apply to web and mobile apps. If you don't need frontend access at all, set your rules to reject everything for maximum security.

From the documentation :

The server client libraries bypass all Cloud Firestore Security Rules and instead authenticate through Google Application Default Credentials. If you are using the server client libraries or the REST or RPC APIs, make sure to set up Identity and Access Management (IAM) for Cloud Firestore.