Firebase Rules: How to block anonymous access?












2















Reading the Firebase Rules Documentation I couldn't find anything on how to block anonymous access to a specific collection or document.



In other words, I want to block users who are not logged in, and I also want to block users who are logged in as anonymous. I want to allow only users who are logged in as themselves (through email, Facebook, Google, SMS, etc).



How can I do that?



This is the code I came up with, which doesn't work:



    service cloud.firestore {

      match /databases/{database}/documents {

        }

        match /collectionExample/{documentExample} {

          allow create: if request.auth.uid != null && request.auth.token.isAnonymous != false;              

          allow read: if request.auth.uid == resource.data.userId;

        }

      }

    }





firebase google-cloud-firestore firebase-security-rules







share|improve this question





























    2















    Reading the Firebase Rules Documentation I couldn't find anything on how to block anonymous access to a specific collection or document.



    In other words, I want to block users who are not logged in, and I also want to block users who are logged in as anonymous. I want to allow only users who are logged in as themselves (through email, Facebook, Google, SMS, etc).



    How can I do that?



    This is the code I came up with, which doesn't work:



        service cloud.firestore {
    
      match /databases/{database}/documents {
    
        }
    
        match /collectionExample/{documentExample} {
    
          allow create: if request.auth.uid != null && request.auth.token.isAnonymous != false;              
    
          allow read: if request.auth.uid == resource.data.userId;
    
        }
    
      }
    
    }





    firebase google-cloud-firestore firebase-security-rules







    share|improve this question



























      2












      2








      2








      Reading the Firebase Rules Documentation I couldn't find anything on how to block anonymous access to a specific collection or document.



      In other words, I want to block users who are not logged in, and I also want to block users who are logged in as anonymous. I want to allow only users who are logged in as themselves (through email, Facebook, Google, SMS, etc).



      How can I do that?



      This is the code I came up with, which doesn't work:



          service cloud.firestore {
      
      match /databases/{database}/documents {
      
        }
      
        match /collectionExample/{documentExample} {
      
          allow create: if request.auth.uid != null && request.auth.token.isAnonymous != false;              
      
          allow read: if request.auth.uid == resource.data.userId;
      
        }
      
      }
      
    }





      firebase google-cloud-firestore firebase-security-rules







      share|improve this question
















      Reading the Firebase Rules Documentation I couldn't find anything on how to block anonymous access to a specific collection or document.



      In other words, I want to block users who are not logged in, and I also want to block users who are logged in as anonymous. I want to allow only users who are logged in as themselves (through email, Facebook, Google, SMS, etc).



      How can I do that?



      This is the code I came up with, which doesn't work:



          service cloud.firestore {
      
      match /databases/{database}/documents {
      
        }
      
        match /collectionExample/{documentExample} {
      
          allow create: if request.auth.uid != null && request.auth.token.isAnonymous != false;              
      
          allow read: if request.auth.uid == resource.data.userId;
      
        }
      
      }
      
    }





      firebase google-cloud-firestore firebase-security-rules




      firebase google-cloud-firestore firebase-security-rules






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Nov 21 '18 at 20:17









      Doug Stevenson

      73.1k983104




      73.1k983104










      asked Nov 21 '18 at 19:46









      BlueEffectBlueEffect

      1358




      1358
























          1 Answer
          1






          active

          oldest

          votes


















          2














          I haven't tried this, but I suspect you can use request.auth.token.firebase.sign_in_provider (see the docs for auth). It's supposed to contain the value anonymous for anonymous auth. So, to allow document creates for non-anonymous logged in users:



          allow create: if request.auth.uid != null && request.auth.token.firebase.sign_in_provider != 'anonymous';


          Or, you could change it to only allow certain providers as well, given the other possible values for token firebase.sign_in_provider in the docs.






          share|improve this answer
























          • I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

            – BlueEffect
            Nov 22 '18 at 18:14













          Your Answer






          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "1"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














          draft saved

          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53419498%2ffirebase-rules-how-to-block-anonymous-access%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          2














          I haven't tried this, but I suspect you can use request.auth.token.firebase.sign_in_provider (see the docs for auth). It's supposed to contain the value anonymous for anonymous auth. So, to allow document creates for non-anonymous logged in users:



          allow create: if request.auth.uid != null && request.auth.token.firebase.sign_in_provider != 'anonymous';


          Or, you could change it to only allow certain providers as well, given the other possible values for token firebase.sign_in_provider in the docs.






          share|improve this answer
























          • I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

            – BlueEffect
            Nov 22 '18 at 18:14


















          2














          I haven't tried this, but I suspect you can use request.auth.token.firebase.sign_in_provider (see the docs for auth). It's supposed to contain the value anonymous for anonymous auth. So, to allow document creates for non-anonymous logged in users:



          allow create: if request.auth.uid != null && request.auth.token.firebase.sign_in_provider != 'anonymous';


          Or, you could change it to only allow certain providers as well, given the other possible values for token firebase.sign_in_provider in the docs.






          share|improve this answer
























          • I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

            – BlueEffect
            Nov 22 '18 at 18:14
















          2












          2








          2







          I haven't tried this, but I suspect you can use request.auth.token.firebase.sign_in_provider (see the docs for auth). It's supposed to contain the value anonymous for anonymous auth. So, to allow document creates for non-anonymous logged in users:



          allow create: if request.auth.uid != null && request.auth.token.firebase.sign_in_provider != 'anonymous';


          Or, you could change it to only allow certain providers as well, given the other possible values for token firebase.sign_in_provider in the docs.






          share|improve this answer













          I haven't tried this, but I suspect you can use request.auth.token.firebase.sign_in_provider (see the docs for auth). It's supposed to contain the value anonymous for anonymous auth. So, to allow document creates for non-anonymous logged in users:



          allow create: if request.auth.uid != null && request.auth.token.firebase.sign_in_provider != 'anonymous';


          Or, you could change it to only allow certain providers as well, given the other possible values for token firebase.sign_in_provider in the docs.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Nov 22 '18 at 6:53









          Doug StevensonDoug Stevenson

          73.1k983104




          73.1k983104













          • I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

            – BlueEffect
            Nov 22 '18 at 18:14





















          • I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

            – BlueEffect
            Nov 22 '18 at 18:14



















          I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

          – BlueEffect
          Nov 22 '18 at 18:14







          I tested, using request.auth.token.firebase.sign_in_provider != 'anonymous', that works, thanks

          – BlueEffect
          Nov 22 '18 at 18:14




















          draft saved

          draft discarded




















































          Thanks for contributing an answer to Stack Overflow!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid …



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53419498%2ffirebase-rules-how-to-block-anonymous-access%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          -

          Popular posts from this blog

          Create new schema in PostgreSQL using DBeaver

          Image
          0 At the beginning of my current job I had limited access to DB but recently my role is changed to superuser, admin, and owner. My colleague who was the previous DB admin is able to create a schema or change the permissions as there is a permission tab in the properties and he can change permissions by clicking easily. Would you please let me know how I can create schema and change permissions as well? Why his dbeaver looks different from me? He can easily right click on the schema folder on top of all schemas on the left side column and select create new schema while I do not have that, like the following picture I found on the internet. postgresql database-schema dbeaver share | improve this question
          Read more

          Deepest pit of an array with Javascript: test on Codility

          Image
          0 $begingroup$ This is the question from a Codility test, as a task in an interview: DeepestPit - problem description A non-empty zero-indexed array A consisting of N integers is given. A pit in this array is any triplet of integers (P, Q, R) such that: ·         0 ≤ P < Q < R < N; ·         sequence [A[P], A[P+1], ..., A[Q]] is strictly decreasing, i.e. A[P] > A[P+1] > ... > A[Q]; ·         sequence A[Q], A[Q+1], ..., A[R] is strictly increasing, i.e. A[Q] < A[Q+1] < ... < A[R]. The depth of a pit (P, Q, R) is the number min {A[P] − A[Q], A[R] − A[Q]}. For example, consider array A consisting of 10 elements such that: A[0] = 0 A[1] = 1 A[2] = 3 A[3] = -2 A[4] = 0 A[5] = 1 A[6] = 0 A[7] = -3 A[8] = 2 A[9] = 3 Triplet (2, 3, 4) is
          Read more

          Costa Masnaga

          Image
          .mw-parser-output .avviso .mbox-text-div>div,.mw-parser-output .avviso .mbox-text-full-div>div{font-size:90%}.mw-parser-output .avviso .mbox-image div{width:52px}.mw-parser-output .avviso .mbox-text-full-div .hide-when-compact{display:block} Questa voce o sezione sull'argomento Lombardia non cita le fonti necessarie o quelle presenti sono insufficienti . Puoi migliorare questa voce aggiungendo citazioni da fonti attendibili secondo le linee guida sull'uso delle fonti. Segui i suggerimenti del progetto di riferimento. Costa Masnaga comune Localizzazione Stato   Italia Regione Lombardia Provincia Lecco Amministrazione Sindaco Sabina Panzeri (Al centro il cittadino) dall'08/06/2009 Territorio Coordinate 45°46′N 9°17′E  /  45.766667°N 9.283333°E 45.766667; 9.283333  ( Costa Masnaga ) Coordinate: 45°46′N 9°17′E  /  45.766667°N 9.283333°E 45.766667; 9.283333  ( Costa Masnaga ) Altitudine 318 m s.l.m
          Read more