Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

Firebase GET request blocked by simple firebase rules

I have the following collection group query:

const userInRooms = await firestore()
        .collectionGroup('userRooms')
        .where('uid', '==', authenticatedUser.uid)
        .get();

And it works fine.
But since I added security rule:

match /rooms/{docId} {
      allow read;
      allow write;
      match /userRooms/{docId} {
        allow read;
        allow write;
      }
    }

userRooms is subcollection in rooms.
It stopped working and I getting:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

NativeFirebaseError: [firestore/permission-denied] The caller does not have permission to execute the specified operation.

>Solution :

Cascading the sub-collections rules that way doesn’t work for collection group queries. A recursive wildcard must be present at the beginning of the path so it’ll match any collections with that name. Try:

match /rooms/{docId} {
  //...
}

match /{path=**}/userRooms/{docId} {
  allow read, write: if true;
}

Do change the rules as required instead of allowing everyone to read the database (unless they are allowed to).

Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading