I have a small web-based Flutter application that uses Firebase/Firestore. The security rules are allow read, write; I got an anonymous email from a (friendly) hacker stating that "Our Firebase database credentials are leaked in response to a request" (??)…
I have an flutter app that talks to the same collection and everything works fine. However, I have another flutter app app which I have also added to Firebase and done all the configuration as in the first app but…
In Firestore, I have data within a sub-collection called 'exclusiveB', and a field of this collection's documents is 'creditCard' which accepts boolean values. Within the same Firestore referred to above, I have another sub-collection called 'exclusiveA'. I wrote a security…
In Firestore rules I created this function: function rulesTest() { let doc = get(/databases/$(database)/documents/someCollection/someDocId); return doc == null; } According to the documentation of the get() method the return type of it is: non-null rules.firestore.Resource the document, or null if…
Basically, i want users to create account and write data like Name, User, etc. to firestore database. But i don't know the rules for that. W/Firestore( 9927): (24.5.0) [Firestore]: Write failed at Users/FPhBBFybqXfCuXtFYTVO: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null} I/flutter…
I am trying to test firestore security rules that I have wrote, but every time I am trying to run my tests I am getting timeout error. Before I run tests, I start my firestore emulators with such command: ❯…
I'm probably missing something simple. I have been stuck on this for a while and its critical. Any assistance would be appreciated. I have a firestore storage database with rules that allow everyone to read(see) images. rules_version = '2'; service…
I was writing a rule for my "users" collection that looks like this: match /users/{userId} { // Returns true if auth's email is empty and user's // insensitiveEmail is empty or non-existent function emailDoesNotExist(resource) { return request.auth.token.email.size() == 0 &&…
Below code works if I have collection (in this case suppliers) function isNotRestrictedinSuppliers(){ let value=3; let suppliers=get(/databases/$(database)/documents/users/$(request.auth.uid)/settings/suppliers); return suppliers.data.suppliers_array.size() < value; //return true; } match /suppliers/{document=**}{ allow read,update, delete: if isSignedIn() && isValidUser(); //above is the same like allow write;…
I am trying to get all posts made between two users to each other in one firestore query, but I get permission denied. I have a "posts" collection with post documents that have the following fields: { to : uid_of_user_receiving_post,…