Skip to content

Remove globs from default Firestore rules #8510

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Remove globs from default Firestore rules #8510

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8e466ea
Remove globs from default Firestore rules
joehan May 5, 2025
aaf1831
Make default security rules safer
joehan May 5, 2025
4994a33
Merge branch 'master' into jh-sec-rules-globs
joehan May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 10 additions & 12 deletions templates/init/firestore/firestore.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,14 @@
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
// This rule allows anyone with your database reference to view, edit,
// and delete all data in your database. It is useful for getting
// started, but it is configured to expire after 30 days because it
// leaves your app open to attackers. At that time, all client
// requests to your database will be denied.
//
// Make sure to write security rules for your app before that time, or
// else all client requests to your database will be denied until you
// update your rules.
allow read, write: if request.time < timestamp.date({{IN_30_DAYS}});
}
// This rule allows anyone with your database reference to view, edit,
// and delete all data in your database. It is useful for getting
// started, but it is configured to expire after 30 days because it
// leaves your app open to attackers. At that time, all client
// requests to your database will be denied.
//
// Make sure to write security rules for your app before that time, or
// else all client requests to your database will be denied until you
// update your rules.
allow read, write: if request.time < timestamp.date({{IN_30_DAYS}});
}
}
Loading