5

I am trying to restrict firebase storage based on user role.

Database:
    users
        <uid>
            admin=false
            ... ... ...

I am trying to use the following kind of rule in firebase storage:

root.child('users').child(auth.uid).child('user').child('admin').val() == true

I am getting access denied after adding this to the write rule.

Thanks.

Ahsan
  • 2,964
  • 11
  • 53
  • 96
  • The Firebase Storage security rules cannot refer to data in the Database. See [this answer](http://stackoverflow.com/questions/38188459/create-group-access-to-firebase-storage-without-using-custom-authorization) or [this one](http://stackoverflow.com/questions/38157858/firebase-storage-whats-the-proper-rules-for-user-based-uploading-deleting) for ways to do something like role-based security. – Frank van Puffelen Aug 28 '16 at 04:00
  • Thanks Frank. Its a little hacky, but I guess thats all I can do for now. – Ahsan Aug 28 '16 at 20:05
  • You can use "custom claims", you have to set the custom claims in one of your Firebase Functions, but they'll be passed to Firebase Storage. – Ryan Taylor Mar 27 '19 at 22:03

1 Answers1

3

As Frank van Puffelen pointed out in his comment:

function isAdminUser() {
    return request.auth.uid in {
        "yaddayadddayaddUserIDKey":"User Name1"
    };
}

service firebase.storage {
    match /b/<appName>.appspot.com/o {
        match /{allPaths=**} {
            allow read;
            allow write: if request.auth != null && isAdminUser();
        }
   }
}
Ahsan
  • 2,964
  • 11
  • 53
  • 96