用于删除的Firebase Cloud Storage安全规则 [英] Firebase Cloud Storage security rule for deleting

问题描述

我正在使用Firebase Cloud Storage开发Web应用程序.我想为删除文件中的文件设置不同的安全规则.根据文档，似乎write包括了两者.有人知道如何解决这个问题吗?

Hi I am using Firebase Cloud Storage to develop web application. I would like to set different security rules for setting file from deleting file. It seems that write includes both of them according to the document. Does anyone know how to solve this problem?

我想做的就是这个.

1. 任何人登录后都可以设置文件.
2. 只有设置文件的用户才能删除它.

推荐答案

您可以使用规则中的request.resource == null检测到文件正在删除.

You can detect that a file is being deleted with request.resource == null in your rule.

但是文件对象(我知道)中没有属性可以知道谁创建了文件.

But there is no property in the file objects (that I know of) to know who created the file.

一种常见的方法是将文件存储在标识其创建者的路径下，例如/users/$uid/filename.使用该结构，您可以像这样检查:

A common approach is to store the files under a path that identifies their creator, e.g. /users/$uid/filename. With that structure you can check like this:

match /users/{userId}/profilePicture.png {
  allow read;
  allow write: if request.auth.uid == userId && request.resource == null;
}

另一种选择是将owner属性添加到每个文件的元数据，然后检查:

An alternative would be to add an owner property to the metadata of each file and then check:

match /{fileId} {
  allow read;
  allow write: if (request.auth.uid == resource.metadata.owner && request.resource == null);
}

这篇关于用于删除的Firebase Cloud Storage安全规则的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！