Cloud Firestore安全规则仅允许从Firebase功能写入 [英] Cloud Firestore Security Rules allow write only from Firebase function

问题描述

我真的很希望能够通过只允许将Firebase函数写入特定集合来保护我的Firestore数据库...我将如何去做呢?看那里的文档，我找不到任何可以说明您如何执行此操作的文件.例如，我正在寻找类似的东西:

I'd really like to be able to secure my firestore db by allowing only firebase functions to write to the specific collection... how would I go about doing that? Looking at there documentation I do not find anything that might state how you could do that. For instance, I am looking for something like:

service cloud.firestore {
  match /databases/{database}/documents {

    // Match any document in the 'cities' collection
    match /cities/{city} {
      allow read;
      allow write: if <from firebase function>;
    }
  }
}

推荐答案

Firebase代码的Cloud Functions通常使用Firebase Admin SDK访问其他Firebase产品.无论如何设置权限，Admin SDK都将具有对Firestore的完全读取和写入访问权限.您既不能明确允许也不拒绝对Admin SDK的访问，这意味着您也不能明确允许也不拒绝对Cloud Functions的访问.

Cloud Functions for Firebase code generally accesses other Firebase products using the Firebase Admin SDK. The Admin SDK will have full read and write access to Firestore, no matter how the permissions are set. You can neither explicitly allow nor deny access to the Admin SDK, which means you also can't explicitly allow nor deny access to Cloud Functions.

如果您只希望后端读取和写入数据库的某些部分，但不读取任何移动客户端应用程序，则只需完全拒绝对所有客户端的访问，然后让Admin SDK进行工作即可.

If you just want your backend to read and write some part of your database but none of your mobile client apps, simply reject access to all clients entirely, and let the Admin SDK do its work.

service cloud.firestore {
  match /databases/{database}/documents {

    // Match any document in the 'cities' collection
    match /cities/{city} {
      allow read: if false;
      allow write: if false;
    }
  }
}

这篇关于Cloud Firestore安全规则仅允许从Firebase功能写入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！