0

I am currently building two apps(admin and customer) and both have added in a single firebase project. Both apps are using Firebase Auth(Phone Number) registration process. The admin app is mostly saving details in Firestore DB and the customer app is only can fetch these details for viewing purposes.

Currently, I don't define any rules for them as I am a little new in Firestore/Firebase Rules. But I am wondering to add some rules which will give permission to fetch only those apps which I have added in the same Firebase project where my admin app is. I may be wrong but I think anyone can able to access my admin data by if they will get those names or keys which I am using in my Collections.

So is there any way or rules which will give the data accessing permission to specific apps that I have added in my same firebase project?

Ranjit
  • 5,130
  • 3
  • 30
  • 66

1 Answers1

2

There is no way to limit access to "just this app" in Firebase security rules. Anyone can take the configuration data from your app and use it to call the same API as you app uses.

For this reason you will need to make sure that your security rules model the logic that you want. You'll typically replicate some of the data access logic between your client-side application code, and the server-side security rules. This means that you're modeling who can take certain actions, not what code/application they use to do that.

Also see:

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • Thanks, Frank. But I have used firebase auth and also added `auth != null` in rules already. I am a little confused as you said `replicate some of the data access logic between your client-side application code`. So is there any other things I have to add in my client-side code? It will be helpful if you gave any example links. – Ranjit Jul 20 '20 at 18:39
  • 1
    That `auth != null` is actually already a great example: your code signs the user in, and your rules ensure that the user is signed in. Aside from that, it's hard to give broad examples, but these docs are a great place to get started: https://firebase.google.com/docs/rules/get-started – Frank van Puffelen Jul 20 '20 at 19:23