11 - Setup Security Rules

🚀 Set Up Firestore Security Rules

By default, your database is locked. You need to add rules to protect your user data.

→ In the Firestore Database section, click the "Rules" tab.

→ Delete the existing rules

→ Paste in the following rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Root user document
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;

      // Anything nested inside this user:
      // subcollections, documents, folders, files, unlimited levels
      match /{allPaths=**} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
      }
    }
  }
}

💡

This code lets uses add, update, delete information in their own document (in other words their profile fields e.g. name, email). A user can also add, update, delete collections in their own document. (in other words, they can create folders inside their profile e.g. ‘files’ folder )

→ Click the "Publish" button to save and apply the new rules.

Your database is now secured, and users can only access their own files and profile information.