Firebase rules scanner: kune na Firestore, Realtime Database, kei na Storage rules sa dola

Na sala e kunei kina na open Firebase rules ena scanner

Na Firebase services era expose mata ni URL e well-known ka predictable. E dua na scanner sega ni dua na credentials e rawa ni probe na yadua ka raica ke yaco na anonymous reads. Na FixVibe baas.firebase-rules check e cici ena tolu na independent probes — dua ena Firebase service yadua:

• <strong>Firestore.</strong> The scanner extracts the project ID from the deployed app's bundle (it's in <code>firebase.initializeApp({ projectId: ... })</code>), then issues <code>GET https://firestore.googleapis.com/v1/projects/[project-id]/databases/(default)/documents/[collection]:listDocuments</code> against common collection names. A <code>200 OK</code> with documents in the response means <code>allow read</code> is permissive.
• Realtime Database. Na scanner e probe na https://[project-id]-default-rtdb.firebaseio.com/.json. Ke wilika rawa na root vakaivakatakilakila, na response e na database tree taucoko vaka JSON. E dua na test rauti — query na .json?shallow=true, e tukuna mai na top-level keys ga — finding ena rua na sala.
• Cloud Storage. Na scanner e query https://firebasestorage.googleapis.com/v0/b/[project-id].appspot.com/o. Ke listdraw na response na file names sega na authentication, sa anon-listable na bucket. Na listable storage e dua na finding ke mada ga sa denied na individual file downloads — na attackers era enumerate na bucket me kune na guessable filenames.

Na ka dina e tu na test-mode footgun

Na Firebase's quickstart documentation e vakacurumi e dua na rule block era dau copy ena internet:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

Na Firebase e dau cakava e dua na automatic 30-day expiry ena rules oqo. Sa veisau: ena gauna oqo na rules e tudei ke sega ni veisautaka na developer. Na AI coding tools — sa vakavulici ena yabaki ni documentation kei na test-mode block — era dau cakava verbatim ka tukuna ki na developer "oqo nomu security rule." Sega ga.

Na tale na variants era basika ena production ia era tautauvata na permissive:

// future-date variant — equivalent to "if true"
allow read, write: if request.time < timestamp.date(2099, 1, 1);

// authenticated-user variant — any signed-in user reads and writes anything
allow read: if true;
allow write: if request.auth != null;

// any-auth variant — any signed-in user owns every document
allow read, write: if request.auth != null;

• Dua na future-timestamp variant: e dua na rule e vakadonuya na ka kece me yacova e dua na siga mai liu. E sega vakaduadua ni mudu (raica na block highlighted ena cake).
• allow read: if true; allow write: if request.auth != null; — public reads, na authenticated user kece e rawa ni vola.
• allow read, write: if request.auth != null; — na user kece sa signed-in e rawa ni wilika se vola na document kece, kei na nodra data na tale na user.

Na cava mo cakava ni kune e dua na open rule na scanner

Na open Firebase rules e dua na runtime emergency. Na fix e tautauvata na shape ena tolu na services: scope na rule yadua ki na request.auth.uid kei na explicit owner field. Na service yadua kei na nona rule syntax:

Firestore

match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }. Na path-segment binding {userId} e yaco me dua ga na document e rawa ni tara na user.

match /users/{userId} {
  allow read, write: if request.auth != null
                     && request.auth.uid == userId;
}

Realtime Database

<code>{ "rules": { "users": { "$uid": { ".read": "$uid === auth.uid", ".write": "$uid === auth.uid" } } } }</code>. The <code>$uid</code> wildcard captures the path segment for comparison.

{
  "rules": {
    "users": {
      "$uid": {
        ".read":  "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Cloud Storage

service firebase.storage { match /b/{bucket}/o { match /users/{userId}/{allPaths=**} { allow read, write: if request.auth.uid == userId; } } }. Ivakarau: biuta na file ena ruku ni users/[uid]/[filename] ka vakavotuya ena path na taukei.

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

Deploy na rules mai na Firebase CLI: firebase deploy --only firestore:rules, firebase deploy --only database, firebase deploy --only storage. Vakadinadinataka me tiko na rules vou ena production ni o re-run na FixVibe scan — na baas.firebase-rules finding ena dredre.

firebase deploy --only firestore:rules
firebase deploy --only database
firebase deploy --only storage

Na kena vakatauvatani kei na Firebase built-in tools

Na Firebase Console e vakaraitaka na rules tu ia e sega ni audit mai na runtime behaviour. Na Firebase Rules simulator e vakadonuya mo test na rule logic kei na synthetic requests — yaga ia local. Na rua na tools era sega ni tukuni kina iko na ka era tukuna na nomu production rules ki na unauthenticated attacker ena public internet. Na external scanner me vaka na FixVibe (se na Burp Suite kei na manual configuration) e duabau ga e probe mai na angle vata kei na attacker. Na Google's own App Check e mitigate na abuse ia e sega ni substitute na correctly-scoped rules.

Na taro era dau tarogi

Tikitiki tarava

Cakava e dua na FixVibe scan ena saumi ki na nomu production URL — na baas.firebase-rules check e ship ena plan kece ka flag na open rules ena Firestore, Realtime Database, kei na Cloud Storage. Me dua na vakamacala vakavakauca ki na allow read, write: if true pattern, vakaraica Firebase allow read, write: if true explained. Me dua na rai vakatauvatani ena Supabase, Firebase, Clerk, kei na Auth0, wilika BaaS misconfiguration scanner.