Can a user read a collection of users in firestore from frontend?-CodePudding

I am saving the below Data in the user's collection in firebase

{
 "uid":"randomid",
 "name":"name",
 "number":"1234"
 }

when I try to check if the user exists the below code works ok

const result = await firestore().collection('users').where('uid', '==', userid).get()

so can an authenticated user read the whole users' collections?

const result = await firestore().collection('users').get()

What security rules I can write to prevent users from reading a collection but only reading their info based on uid?

CodePudding user response：

In security rules you can split the read access to get and list. So if you want the give access to each user to get only his own data you need to use the following rule (I assume each user document in the collection is the uid of this user):

match /users/{user} {

  function isUserOwner() {
    return request.auth.uid == user
  }
  
  allow get: if isUserOwner();
  allow list: if false;
}

CodePudding user response：

First you need to set the uid field to the UID of the user who created the document.

To get the current user id See documentation

const uid = user.uid;

To add the currently logged in User id as a field visit stack overflow example link for javascript

After adding UID you can use request.auth and resource.data variables to restrict read and write access for each document to the respective users. Consider a database that contains a collection of story documents. Have a look at below example

{
  title: "A Great Story",
  content: "Once upon a time...",
  author: "some_auth_id",
  published: false
}

You can use below security rule to restrict read and write access for each story to its author:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{storyid} {
      // Only the authenticated user who authored the document can read or write
      allow read, write: if request.auth != null && request.auth.uid == resource.data.author;
    }
  }
}

Note that the below query will fail for the above rule even if the current user actually is the author of every story document. The reason for this behavior is that when Cloud Firestore applies your security rules, it evaluates the query against its potential result set, not against the actual properties of documents in your database

// This query will fail
db.collection("stories").get()

The appropriate query for the above rule is

// This query will work
var user = firebase.auth().currentUser;

db.collection("stories").where("author", "==", user.uid).get()

For additional information on the above rules and query see official documentation