Eskanè règ Firebase: jwenn règ louvri nan Firestore, Realtime Database, ak Storage

Kijan eskanè a jwenn règ Firebase louvri

Sèvis Firebase ekspoze fòm URL byen konnen, previzib. Yon eskanè san kalifikasyon kapab sond chak youn epi obsève èske lekti anonim reyisi. Tcheke baas.firebase-rules FixVibe mache nan twa sondaj endepandan — yon pa sèvis Firebase:

• <strong>Firestore.</strong> The scanner extracts the project ID from the deployed app's bundle (it's in <code>firebase.initializeApp({ projectId: ... })</code>), then issues <code>GET https://firestore.googleapis.com/v1/projects/[project-id]/databases/(default)/documents/[collection]:listDocuments</code> against common collection names. A <code>200 OK</code> with documents in the response means <code>allow read</code> is permissive.
• Realtime Database. Eskanè a sond https://[project-id]-default-rtdb.firebaseio.com/.json. Si rasin lan lizib anonimman, repons lan se tout pyebwa baz done a kòm JSON. Yon tès pi konsèvatif demand .json?shallow=true, ki retounen kle nivo-tèt sèlman — yon dekouvèt nenpòt fason.
• Cloud Storage. Eskanè a demand https://firebasestorage.googleapis.com/v0/b/[project-id].appspot.com/o. Si repons lan liste non dosye san otantifikasyon, bokè a lis-anon. Depo lis se yon dekouvèt menm lè telechajman dosye endividyèl refize — atakè enimere bokè a pou jwenn non dosye yo kapab devine.

Sa pyèj mòd-tès la reyèlman sanble

Dokimantasyon kòmansman vit Firebase gen ladan youn nan blòk règ ki kopye plis sou entènèt la:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

Firebase te konn ajoute yon ekspirasyon otomatik 30-jou sou règ sa yo. Sa chanje: jodi a règ yo pèsiste pou tout tan sof si devlopè a ranplase yo. Zouti kodaj IA — antrene sou ane dokimantasyon ki gen blòk mòd-tès la — souvan voye li mo-pou-mo epi di devlopè a "sa a se règ sekirite ou." Li pa.

Lòt varyant ki parèt nan pwodiksyon men menm jan an pèmisif:

// future-date variant — equivalent to "if true"
allow read, write: if request.time < timestamp.date(2099, 1, 1);

// authenticated-user variant — any signed-in user reads and writes anything
allow read: if true;
allow write: if request.auth != null;

// any-auth variant — any signed-in user owns every document
allow read, write: if request.auth != null;

• Yon varyant orodataj-fiti: yon règ ki pèmèt tout bagay jiska yon dat lwen nan fiti. Pa janm efektivman ekspire (gade blòk ki mete-aksan anwo a).
• allow read: if true; allow write: if request.auth != null; — lekti piblik, nenpòt itilizatè otantifye kapab ekri.
• allow read, write: if request.auth != null; — nenpòt itilizatè konekte kapab li oswa ekri nenpòt dokiman, ki gen ladan done lòt itilizatè.

Sa pou fè lè eskanè a jwenn yon règ louvri

Règ Firebase louvri se yon ijans ekzekisyon. Ranjman an se menm fòm atravè twa sèvis yo: pòte chak règ sou request.auth.uid kont yon chan pwopriyetè eksplisit. Chak sèvis gen pwòp sentaks règ li:

Firestore

match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }. Lyazon segman-chemen {userId} a vin sèl dokiman itilizatè a kapab manyen.

match /users/{userId} {
  allow read, write: if request.auth != null
                     && request.auth.uid == userId;
}

Realtime Database

<code>{ "rules": { "users": { "$uid": { ".read": "$uid === auth.uid", ".write": "$uid === auth.uid" } } } }</code>. The <code>$uid</code> wildcard captures the path segment for comparison.

{
  "rules": {
    "users": {
      "$uid": {
        ".read":  "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Cloud Storage

service firebase.storage { match /b/{bucket}/o { match /users/{userId}/{allPaths=**} { allow read, write: if request.auth.uid == userId; } } }. Konvansyon: estoke dosye anba users/[uid]/[filename] epi kite chemen an ranfòse pwopriyete.

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

Deplwaye règ via Firebase CLI: firebase deploy --only firestore:rules, firebase deploy --only database, firebase deploy --only storage. Verifye nouvo règ yo nan pwodiksyon lè ou re-lanse eskanè FixVibe a — dekouvèt baas.firebase-rules ta dwe efase.

firebase deploy --only firestore:rules
firebase deploy --only database
firebase deploy --only storage

Kijan sa konpare ak zouti enkòpore Firebase

Firebase Console montre w règ aktyèl yo men li pa odite yo kont konpòtman ekzekisyon. Similatè Règ Firebase a kite ou teste lojik règ kont demand sentetik — itil men lokal. Pa gen zouti ki di w sa règ pwodiksyon ou aktyèlman retounen bay yon atakè anonim sou entènèt piblik la. Yon eskanè ekstèn tankou FixVibe (oswa Burp Suite ak konfigirasyon manyèl) se sèl bagay ki sond depi menm ang yon atakè ta. App Check pwòp Google a mitige abi men pa ranplase pou règ ki pòte-kòrèkteman.

Kesyon ki poze souvan

Etap pwochèn

Lanse yon eskanè FixVibe gratis kont URL pwodiksyon ou — tcheke baas.firebase-rules voye sou chak plan epi drapo règ louvri atravè Firestore, Realtime Database, ak Cloud Storage. Pou yon eksplikasyon pi pwofon sou modèl allow read, write: if true espesifik, gade Firebase allow read, write: if true eksplike. Pou view parapli atravè Supabase, Firebase, Clerk, ak Auth0, li Eskanè move konfigirasyon BaaS.