How can I filter requests to Google Cloud Storage depending on their HTTP headers?

Question

My use case is that I have pretty large files (>2GB, these are Cloud Optimized Geotiffs) on Google Cloud Storage, which can be used in applications through HTTP range requests.

I would like to filter out requests that are missing the Range header.

This would avoid the case of users downloading the whole file. (I guess someone could still make a range request for the whole file with a bit of work, but i am not concerned about this.)

The documentation ( https://firebase.google.com/docs/storage/security/rules-conditions#request_evaluation ) says "HTTP headers and authentication state are also included", so I would expect to be able to use this information in the security rules.

Is it possible at all and if it is, how?

I cannot find any example of using HTTP headers in the security rules conditions. I have also tried the rules playground in Firebase, but didn't figure out how to access the request headers.

Answer 1

It doesn't seem like there's any way to access HTTP headers. The only request variables are those in the document

You can try the request.params variable which will be populated with query params present in the request

eg. <firebase storage url>?myParam=true -> request.params.myParam == "true" should work

Answer 2

No, it is not possible to filter requests depending on HTTP headers.

The request variable in the security rules does not include HTTP headers. (As stated by a firebaser in the comments of Roopa M's answer.) The documentation has been updated since this question was asked, and does not state any longer that this information is included.

Roopa M's answer gives an idea to filter requests based on query parameters, which might help you, but is independent from HTTP headers.

In order to really handle queries according to HTTP headers in the context of firebase, it is probably necessary to rely on a cloud function that will act as middleware. These have access to the full HTTP request if i am not mistaken.

Alternatively, this kind of rule should be reasonably easy to implement in a regular web server like Nginx, if you have the option to build your project in such an environment.