Firebase rules allow every read and write

Symptom

The app was created in Firebase Test mode, or the rules say allow read, write: if true. Anyone who knows the project can read and overwrite the data.

Root cause

Firebase's insecure-rules guide says the console offers Locked mode or Test mode. Test mode grants access to all users. The guide's open-access example is allow read, write: if true, and the comment in that example says never use it in production because anyone can overwrite the database. The same page says a deployed app is on the internet even if you think you are the only user. This applies when the generated app uses Cloud Firestore, Realtime Database, or Cloud Storage.

In this project's Firebase rules only, replace open rules.

For Cloud Firestore, start from owner checks rather than if true. Example shape, adapted to the real field name:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /items/{id} {
      allow read, delete: if request.auth != null && request.auth.uid == resource.data.owner_uid;
      allow create: if request.auth != null && request.auth.uid == request.resource.data.owner_uid;
      allow update: if request.auth != null
        && request.auth.uid == resource.data.owner_uid
        && request.auth.uid == request.resource.data.owner_uid;
    }
  }
}

Do the same for Storage paths. Deploy the rules to your own project. Do not leave if true on production data.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Firebase console, open Rules for Firestore, Realtime Database, and Storage.
2. Confirm production rules are not allow read, write: if true, and not ".read": true / ".write": true.
3. Use the Rules Simulator in your project as a signed-out user. Reads and writes of private documents should be denied.

Sources

• Firebase: Avoid insecure rules