Firebase kamachi escáner: jist'arata Firestore, Realtime Database, ukat Storage kamachinak jikxataña

Kunjam escáner jist'arata Firebase kamachinak jikxati

Firebase servicios uñt'ata, tantiyañiri URL formanak qhanstayapxi. Mä escáner jan credenciales sapaqatax sondear ukat anónimo ullañanaka éxito-niri uñakipxaspa. FixVibe baas.firebase-rules verificación kimsa independiente sondeo apnaqi — mä sapa Firebase servicio:

• <strong>Firestore.</strong> The scanner extracts the project ID from the deployed app's bundle (it's in <code>firebase.initializeApp({ projectId: ... })</code>), then issues <code>GET https://firestore.googleapis.com/v1/projects/[project-id]/databases/(default)/documents/[collection]:listDocuments</code> against common collection names. A <code>200 OK</code> with documents in the response means <code>allow read</code> is permissive.
• Realtime Database. Escáner https://[project-id]-default-rtdb.firebaseio.com/.json sondeyi. Raízatakix anónimamente ullantirkpan, respuestax tukuyat base de datus arbol JSON apsuyi. Mä juk'amp conservador prueba .json?shallow=true ukar consultay, ukax mayïr nivel llawinak ukak kuti — jikxatäwi pä caso.
• Cloud Storage. Escáner https://firebasestorage.googleapis.com/v0/b/[project-id].appspot.com/o ukar consultay. Respuesta archivu sutinak jan autenticación uchchpan, bucket anon-listable. Listable storage mä jikxatäwi sapa archivu downloads negatakipanasa — atacantenakax bucket enumeri tantiyañiri sutinak jikxatañataki.

Test-mode jiyantawi kunjamasa verdaderament

Firebase quickstart documentación internet ukan juk'amp copy-yapxki uka kamachi bloques apkati:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

Firebase nayrax mä automático 30-uru caducidad aka kamachinakar uchayata. Mayjasiwa: jichha kamachinakax viviwa janipuni desarrolladorax armtkpan ukax. IA codificación yänakax — documentación nayra maranak test-mode bloquex apkatki uka ukat yatxati — frecuentemente exactamente arsupxi ukat desarrolladorax "akax aka jark'aqaña kamachi" sapxi. Janiwa.

Yaqha variantes production ukan utjapxi ukasti pachpa permisiva:

// future-date variant — equivalent to "if true"
allow read, write: if request.time < timestamp.date(2099, 1, 1);

// authenticated-user variant — any signed-in user reads and writes anything
allow read: if true;
allow write: if request.auth != null;

// any-auth variant — any signed-in user owns every document
allow read, write: if request.auth != null;

• Mä futuro-timestamp variante: mä kamachi taqi permitki mä urut jaya jaqaykama. Janipuni efectivament caduki (patxan resaltada bloque uñakipt'aña).
• allow read: if true; allow write: if request.auth != null; — público ullañanaka, kun autenticado usuariu qillqaspa.
• allow read, write: if request.auth != null; — kun sign in usuariu kun documento ullkaspa jan ukax qillqaspa, yaqha usuariu datos jiraqayasinsa.

Kun lurañ escáner mä jist'arata kamachi jikxatkpan

Jist'arata Firebase kamachinakax mä runtime emergencia. Askichäwi pachpa forma kimsa servicios uñkattat: sapa kamachi request.auth.uid ukar explícito dueño campo ukar ñiq'iyataya. Sapa servicio propio kamachi sintaxis:

Firestore

match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }. Ruta-segmento amarru {userId} usuariu llamtañ atki sapa documentowa.

match /users/{userId} {
  allow read, write: if request.auth != null
                     && request.auth.uid == userId;
}

Realtime Database

<code>{ "rules": { "users": { "$uid": { ".read": "$uid === auth.uid", ".write": "$uid === auth.uid" } } } }</code>. The <code>$uid</code> wildcard captures the path segment for comparison.

{
  "rules": {
    "users": {
      "$uid": {
        ".read":  "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Cloud Storage

service firebase.storage { match /b/{bucket}/o { match /users/{userId}/{allPaths=**} { allow read, write: if request.auth.uid == userId; } } }. Convención: archivunak users/[uid]/[filename] ukan apsuyaña ukat rutax dueñacht'a fuerzayi.

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

Kamachi Firebase CLI ukamp despliegaña: firebase deploy --only firestore:rules, firebase deploy --only database, firebase deploy --only storage. Machaq kamachinakax production ukan utji verifikaña FixVibe escaneo wasitat apnaqasin — baas.firebase-rules jikxatäwix qhanawxani.

firebase deploy --only firestore:rules
firebase deploy --only database
firebase deploy --only storage

Kunjamas aka Firebase utt'ata yänakamp uñtatayi

Firebase Console jichha kamachinak uñacht'ayatam ukasti janit runtime comportamiento auditkapxi. Firebase Rules simulador kamachi lógica probapxi sintética peticionampi — phuqha ukasti localwa. Jan mä yä janit qhanañchki kun production kamachinakax verdaderament mä atacante anónimomp internet público ukan kutiyki. Mä escáner externo FixVibe (jan ukax Burp Suite manual configurampi) sapa mä yä sondeyi pachpa ángulo kawkir atacanti sondear lurkapan. Google propio App Check abuso mitigayi ukasti janit correctament-uñakipat kamachinak susticki.

Jichhar jiskt'awinaka

Qhipa lurawinaka

Inaki FixVibe escaneo production URL ukar apnaqaña — baas.firebase-rules verificación sapa plan ukan apsuyat ukat jist'arata kamachinak Firestore, Realtime Database, ukat Cloud Storage ukan informi. allow read, write: if true patrón espesificat juk'amp ñiq'iyat explicación uñakipt'añataki, Firebase allow read, write: if true qhanañcha ulla. Supabase, Firebase, Clerk, ukat Auth0 ukar mä jach'a uñjañataki, BaaS jan walt'awi escáner ulla.