Firebase Firestore | Security Rules

In this video you will learn how to write #SecurityRules for your #firestore database.
You will learn the basics and then I will explain how to write rules for this #Notes Application.
⭐ Kite is a free AI-powered coding assistant that will help you code faster and smarter. The Kite plugin integrates with all the top editors and IDEs to give you smart completions and documentation while you’re typing. I've been using Kite for 6 months and I love it! www.kite.com/g...
FREE $100 credit @Digital Ocean: m.do.co/c/3208...
Patreon: / trulymittal
Subscribe: www.youtube.co...
Completed Notes App: github.com/tru...
Firebase Console: console.fireba...
Add Firebase to Project: firebase.googl...
Firebase UI: github.com/fir...
Dependencies:
Firebase Authentication: firebase.googl...
Firebase Firestore: firebase.googl...
FirebaseUI: github.com/fir...
Cloud Storage: firebase.googl...
#yoursTruly #FirebaseSDK #tutorial #android
---------------
More useful videos
---------------
RecyclerView: • Recycler View with com...
ViewModel: • View Model | Live Data...
NavigationComponent: • Navigation Component |...
WorkManager: • Work Manager | Android...
Retrofit: • RETROFIT Tutorial (v 2...
CollapsingToolbar Layout: • Collapsing Toolbar Lay...
BottomNavigation View: • Bottom Navigation View...
KeyframeAnimations: • Keyframe Animations wi...
NightMode: • Night Mode | Dark Mode...
ButterKnife: • Butter Knife | Field a...
SplashScreen: • Splash screen | Launch...
Singletons: • Singletons | What When...
Pull to Refresh in RecyclerView: • Pull to Refresh in Rec...
On item click using Interface in RecyclerView: • RecyclerView item Clic...
Swipe gestures in Recycler View: • Swipe gestures in Recy...
Drag and drop Reorder in Recycler View: • Drag and drop Reorder ...
Filter using SearchView in RecyclerView: • Filter RecyclerView us...
MultiView RecyclerView: • Multi view RecyclerVie...
---------------
What I use
---------------
Mouse: amzn.to/2O9RJtu
Keyboard: amzn.to/2qxajCU
Keyboard 2: amzn.to/2XDWH4X
Monitor: amzn.to/2pDg7dH
Processor: amzn.to/347WWIb
RAM: amzn.to/2QEkUqw
Graphics: amzn.to/33aBrF4
Microphone: amzn.to/2DabdI9
#yoursTRULY #tutorial #howto #android

[@chedders]

Honesty You are far better than even google's Firebase channel! We expect more videos like this.

[@chedders]

pls does this apply to the real time data base

[@zakiaarif3523]

The best explanation of security rules I have ever seen...GOOD JOB

[@mgbhadurudeen336]

You are far better than even google's Firebase channel! We expect more videos on this.

[@bilbobolsondefu4789]

four hours trying to find a tutorial like this. quite bad google,s firebase channel

[@chedders]

This is so true you are very correct.. he is far better

[@manoj-k]

🔥🔥🔥 Best of all security rules video! Thank you 🙏

[@austinevick]

Thanks alot you saved the day

[@jcavenue]

I really recommend this channel! if your looking to learn firebase for your projects

[@ericogieaghahowa6347]

Best lecture from an Indian. Thank you so much.

[@someshsahu4638]

Very nice and detailed explanation thankyou so much 🙏🏼🙏🏼🙏🏼

[@paulovinicius9940]

Dude, wtf! Why are you not at MIT? You are the best teacher in the freaking history! Like and Sub!

[@mafiacodes]

Thanks bro, m glad u liked my content

[@duchailu]

i know it's 3 years later ^^ but man this video deserves a like !!

[@mcifci]

I'm researching about the rules, only you explained clearly firestore rules, we need you bro, also you should explain rules of storage, if you have free time

[@mafiacodes]

the rules work the same way, for example: incase u have a folder named images the u write match /images/{image} ....

[@mcifci]

@@mafiacodes thank you man, yeah ı did it like you say, u r great bro ;)

[@bala-st9cj]

this is better than the firebase documentation

[@mafiacodes]

subscribe like share

[@tariiqd]

Great tutorial. Keep it up!

[@captainmichaelj2321]

Please continue to provide us with great youtube tutorials, this video clearly explained the rules and I was able to solve my issue I have been struggling for days.

[@mafiacodes]

Glad it helps

[@H1MANSHU]

you just explained it amazingly ! Thank you

[@sat_talk]

Thanks bro.. very clear and simple explanation.. ... keep it up

[@mobiletracer4005]

This the best video all others are boring and complex , great job!

[@gyenabubakar]

This is by far the best intro video on Firestore Security Rules I've seen. Good stuff!

[@CodeWithSharon]

I have been searching for this stuff...finally i found it from you bro...you explained it like crystalline ...thank you so much bro

[@mafiacodes]

Subscribe like share

[@TheSpiralnotizblock]

Your video is worth of gold! Thank you so much

[@moganesanm973]

thank you so much for your clear explanation

[@Amro-Omran]

Excellent 👍

[@jayantadas-vf2hf]

thanks again

[@mirak474]

Such a good explanation, thank you for teaching me how to write an application with firestore integration

[@mafiacodes]

Glad u like it

[@ajaykotiyal427]

Excellent explaination with simple examples.

[@christiandavidvalenzuelago4955]

YOU HAVE THE BEST EXPLICATION!! EXCELENT JOB AND THANKS! 🙌🙌🙌

[@mvrdara]

Thanks You explained clearly.

[@umniahalhalaby2110]

thank you

[@Daddytronics]

Great work thank you

[@pratyushkarn1133]

Very good Content

[@MrJatan90]

Amazing tutorial man, thank you so much!

[@yao1646]

Thanks for this fine explanation

[@mafiacodes]

Thanks, subscribe like share

[@rodrickngonyoku5042]

God bless you

[@mafiacodes]

subscribe like share

[@mohamedyoussef8835]

Awesome video ++++++++ 😃

[@mcifci]

Hi bro, can you make another video about rules, like this but a little bit more complex, using a simple chat app for example

[@maheshgharage8480]

Thanks for vedio

[@mafiacodes]

Subscribe like share

[@alilishan]

Brilliant!!!

[@mafiacodes]

Subscribe like share

[@BhajanVishv]

if possible please make a video on how to restrict a user to read data specific number of times so that it will reduce unnecessary spam of reads that cost us, I searched everywhere but nobody explained this concept

[@mafiacodes]

well its typical, and probably u should not do so, better would be to optimise the db schema.

[@AhsanAli-vz6mg]

thanks brother

[@mafiacodes]

Subscribe like share

[@rezahosseinypour6669]

helped a lot

[@mafiacodes]

Subscribe like share

[@ShourovRoy-pk5zm]

Rules for upvote or downvote or comments to others post. What should I do

[@pratyushkarn1133]

How can i Make a User Admin and Check He Is Admin please help

[@infantraj4289]

Hi brother, I understand clearly so, Thanks for that. Would you tell me, Is there possible to write security rules without firebase auth. Because I have managed the authentication of other backend APIs (It is mandatory). Please tell me.

[@gurubhai4918]

Acha hai dost, but security roles ? Admin can do all, less privileged users do less etc ?

[@ayazrafai6273]

Very nice explanation!!! Should I apply a subcollection rule based on the super collection hierarchy? Here, Let's suppose I have a "group" collection as your notes and inside that, I have "posts" collection. Now, I would like to allow users to add a post in case the user is an admin or a member of the "group" collection only. "group" collection will be having an array of "members" Please let help me to get this applied. Thank you!

[@mafiacodes]

Yes you can apply

[@mobiletracer4005]

I had a doubt how we do we set the same rules firebase cloud storage there is no user id there

[@niranjanmagare5193]

This is the best video for firestore security rules. But i want to write rule which can allow read and write for a specific collection which have many documents and in those documents again many collection and so on. Will you help me..?

[@mafiacodes]

Share an example on GitHub and I will try to push security rule

[@ReadersMess]

if any user tries to increase his/her coins or points without watching ad using illegal method how to avoid this, as user can write in his document he can increase points too

[@mafiacodes]

add security rule for writing too...or add some backend code (or probably use firebase functions) to validate it...

[@surenderkumar4010]

Super bro....next firebase function panuinga bro

[@mafiacodes]

Thanks subscribe like share.

[@shakeelali9418]

I have a question how anybody can access our database . If the person want to access database then he needs to have the firebase api keys.

[@mafiacodes]

The keys are in the firebase config file, which we added to out project. And the read/write is protected by security rules. kzbin.info/www/bejne/qnO7hKWjrLCfl5I

[@muhammadmehdi1304]

I don't get the 'allow create: if request.auth != null && request.auth.uid == request.response.data.userID'

[@mafiacodes]

1. request.auth != null - the request is authenticated, ie the user is authenticated 2. request.auth.uid == request.response.data.userID - the authenticated users id matches the userID field in document

[@comboschtap]

@@mafiacodes I was wondering the same actually. What confuses me here is the fact that if the user is creating a document that does not exist yet, then how is it possible to compare the userID on a still non-existing document? In other words, my question is: How come are you able to get the userID on a document that does not exist yet ( request.response.data.userID)? Other than that, thank you for a great explanation. You wrote this explanation: "request.auth.uid == request.response.data.userID - the authenticated users id matches the userID field in document". But as how I understand, we are just creating that document, so how can we get the document userID?

[@abhishekmirajkar03]

What would be the query to access ?

[@mafiacodes]

Like what?

[@abhishekmirajkar03]

@@mafiacodes I have rules set for my DB that the user should be authenticated, so I'm confused do I have do write anything specific code to access that data in my flutter project Please help it's gonna save my job

[@mafiacodes]

No u don’t if u have specified the access to a particular resource that only authenticated users should access, then firebase will check itself that is the user authenticated provided u are using firebase authentication.

[@gajendrapandeya5081]

Sir what if our app doesn't have authentication system?? What should we do for that?

[@mafiacodes]

then u need to figure out 😉, since it will be an open database

[@gajendrapandeya5081]

@@mafiacodes i have no idea what can i do. Please suggest me the best possible answer. I have searching about this almost from a week. Hope you will help me sir.

[@mafiacodes]

Bro nothing u can do, no auth means no way to protect database since it’s open, or u can use firebase sign in anonymously

[@krishnamohanty5128]

hi sir, thanx for making this video. but i have some error i am facing right now. error is: Listen for Query(users/-M9hU8UJtjjJws3-_UYE) failed: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}. And query : future: Firestore.instance.collection("users").document(widget.profileID).get(), builder: (context, snapshot) . how to fix?

[@mafiacodes]

Check ur security rules

[@krishnamohanty5128]

@@mafiacodes service firebase.storage { match /databases/{database}/documents { match /users/{userId} { allow read, write: if isOwner(userId); } } function isOwner(userId) { return request.auth.uid == userId; } }

[@bongbox]

Can I write a rules to disable a document with expiring timestamp?

[@mafiacodes]

Refer this post on medium medium.com/firebase-developers/what-does-it-mean-that-firestore-security-rules-are-not-filters-68ec14f3d003

[@mcifci]

You said " allow read : if isAuthenticated() && request.auth.uid == resource.data.userId;" this means that only user who is posted that note read note writed by himself/herlself. how other users will read this note

[@mafiacodes]

It’s a personal notes collection only for user if u want others to read then skip the second condition

[@mcifci]

@@mafiacodes does this create a security gap

[@mcifci]

@@mafiacodes In particular, I want to ask that, for example, each user in your firestore has its own field, and it also contains the userId of the user, if we allow everyone to read registered users, do they see all the information in the field, such as userId

[@mcifci]

@@mafiacodes thank you ;);) I need to do more extensive research about security. the videos you make are also really useful

[@mafiacodes]

Yes but u can only return fields u require

[@aviagarwal7528]

Sir i need you help how to use the get function I want to check that current uid is equal to the value field of uid And the path is Teachers----(many documents)------uid=something

[@mafiacodes]

I dint understand please elaborate

[@aviagarwal7528]

@@mafiacodes sir can i get you email id or something so that i can send you an image with details

[@mafiacodes]

you can share on GitHub...

[@aviagarwal7528]

@@mafiacodes stackoverflow.com/questions/61425078/firestore-security-rules-get-function-showing-error this is my question

[@gannafour5726]

Hello Sir, i am still getting a error in reading a documents. can i get your email so i can contact you?

[@mafiacodes]

share ur code on GitHub

[@SGSupport]

Hindi me bol