0

Several questions address whether knowing a Firestore uid allows hackers to edit that person's data, like this question and this question. My question is about security rules to filter when users can read another's data.

Specifically, I have a social media app that allows people to post data anonymously. My data model is /users/{user}/posts/{post}. I use db.collectionGroup("posts") to build a timeline of posts, (some anonymous, others with users' names).

Posts that are not anonymous have a valid uid, so it wouldn't be tough for a hacker to figure out someone's uid, which I'm not concerned about. My concern is whether a hacker could then query usersRef.document(uid).posts.getDocuments(); to get all the posts of that user, including the anonymous ones?

Because my app builds timelines from users "posts" collection, I can't write a rule that they can't read another user's posts. Can I write a rule that they can only read posts with collectionGroup?

buttonsrtoys
  • 2,359
  • 3
  • 32
  • 52

1 Answers1

2

That's not going to be possible with the way things are structured now. Here's the way you write a rule to allow collection group queries, as described in the documentation

    match /{path=**}/posts/{post} {
      allow read: if ...condition...;
    }

The path wildcard in the rule explicitly allows all reads for all collections named "posts". The rule does not limit the reads to only collection group queries - any normal collection query on any "posts" will be allowed.

Bear in mind also that a collection group query would not hide any data from the caller compared to a normal collection query. The query results will still contain a reference to the full path of each document, which includes the document uid in the path.

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
  • Thanks @Doug. It just occurred to me that if I could lockdown usersRef.document(uid) as only accessible to the owner of the uid, that would suit my needs. Or would that also block user users from running groupCollection on posts? – buttonsrtoys Oct 04 '20 at 18:13
  • 1
    There's no rule to "lock down" access to anything. Security rules work only by granting access with conditions. Once the conditions are met when granting access, it can't be revoked by another rule. The only way to prevent access to something is to simply never grant the access at all. – Doug Stevenson Oct 04 '20 at 18:15