Getting started with security rules

With Firestore Security Rules, you can focus on building a great user experience without having to manage infrastructure or write server-side authentication and authorization code.

Security rules provide access control and data validation in a simple yet expressive format. To build user-based and role-based access systems that keep your users' data safe, you need to use Firebase Authentication with Firestore Security Rules.

Security rules version 2

As of May 2019, version 2 of the Firestore security rules is now available. Version 2 of the rules changes the behavior of recursive wildcards {name=**}. You must use version 2 if you plan to use collection group queries. You must opt-in to version 2 by making rules_version = '2'; the first line in your security rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

Writing rules

You will write and manage Firestore Security Rules tailored to the data model you create for the default database and each additional database in your project.

All Firestore Security Rules consist of match statements, which identify documents in your database, and allow expressions, which control access to those documents:

service cloud.firestore {
  match /databases/{database}/documents {
    match /<some_path>/ {
      allow read, write: if <some_condition>;
    }
  }
}

Every database request from a Firestore mobile/web client library is evaluated against your security rules before reading or writing any data. If the rules deny access to any of the specified document paths, the entire request fails.

Below are some examples of basic rule sets. While these rules are valid, they are not recommended for production applications:

Auth required