Firebase Security Rules: A Practical Deep Dive

Security Rules are the first and last line of defence for your Firestore data. Here is what years of production use taught me.

The Core Mental Model

Rules answer one question: "Should this request be allowed?" They do NOT filter results — if a query would match a document a user can't read, the entire query is rejected.

Common Patterns

Role-based access

function isAdmin() {
  return request.auth != null
    && get(/databases/$(database)/documents/users/main/users/$(request.auth.uid)).data.role == 'admin';
}

Protecting updates to sensitive fields

allow update: if isOwner(userId)
  && !('role' in request.resource.data);

Anti-patterns to Avoid

• Never allow read, write: if true in production
• Never trust client-supplied user IDs — always use request.auth.uid
• Never skip testing rules with the Firebase Rules Playground