Cloud Storage - Disabled Public Access Prevention, but Failed

Question

Okay, I was using Flutter and Firebase to upload data into Cloud Storage. I gained the downloadURL which can be accessible on web if people know the URL. I had enabled Public Access Prevention in Google Cloud Storage Console based on this doc and chose Access Control Uniform for this on doc .

I also had added Security Rule in Firebase Cloud Storage, so only Users with certain custom token can use it. But, it seems useless as everyone can get its downloaded URL. My question is why is that I still able to access the file if I am using the same URL which was I stored in Firestore? You can test it on this url .

Can hacker get the download URL I downloaded from Firestore? Is there a secure way to download song from Firebase Cloud Storage so hacker won't get its URL?

Thank you for helping me out.

Updated v2: I just found out that current audio file has its own AuthenticatedUrl as shown on this picture below. How can I get access to this url?

Updated v1:

I think I haven't activated Firebase App Check. Does this feature have ability to prevent it from being accessed publicly or maybe there is other things that I have to do to be able to prevent it being accessed publicly, beside all ways I described above???

Answer 1

Security rules only check if a user can get the download URL and do not restrict anyone from using it. You can use the getData() method instead. It doesn't return any URL and downloads the files directly and is controlled by security rules . So a user must be authenticated to fetch them.

Answer 2

As mentioned in the Answer :

If you're using the FlutterFire Storage library in your app, you can call getData on a reference to the file to get its data. So with that you just need to know the path to the data, and you won't need the download URL in your application. Once you have the data locally, you can create an image out of it with: Converting a byte array to image in Flutter?

Unlike download URLs, the call to getData() is checked by security rules, so you'll have to ensure that the user is permitted to access the file.

You can also refer to this Answer :

For web apps: in the JavaScript/Web SDK using a download URL is the only way to get at the data, while for the native mobile SDKs we also have getData() and getFile() methods, which are enforced through security rules.

Until that time, if signed URLs fit your needs better, you can use those. Both signed URLs and download URLs are just URLs that provide read-only access to the data. Signed URLs just expire, while download URLs don't.

For more information, you can refer to this Github issue where a similar issue has been discussed .