Cloud Firestore rules - Allowing anybody to update one specific field in a document

问题

I'm working on a PoC (Proof of Concept) application that users can download wallpapers to their device. All of the data is served using Cloud Firestore & Storage.

There is NO LOGIN for this application. Anybody can download the application, and immediately download the wallpapers she or he desires.

Bearing that in mind... I would like to have a counter that tracks how many times each specific wallpaper was downloaded.

While I have it "working" - I am questioning the rules I have set up in Firebase..

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read;
      allow write: if request.auth != null;
      allow update: if request.resource.data.counter is number;
    }
  }
}

My thought process with the rules above:

• Anybody can read.
• Only authenticated users can write. (I am managing all of the data with a headless CMS; Flamelink; so the 1 and only authenticated user is myself.)
• Update the counter if the data is a number..

It's that last rule that I am questioning.

Is this a safe method of security to deploy to production?

Again - no login for this application, users can download all of the wallpapers with no authentication, and there will be a counter next to each wallpaper for users to see how many times each wallpaper has been downloaded.

回答1:

The rules are not "secure" by any normal definition of that word. Here's what they allow. Anyone with an internet connection who knows the name of the project (which is easy to get) can:

• Query for any document in the database
• Update any existing document with any numeric value for counter in any document (it doesn't even have to increment, or be a positive integer)

On top of that, anyone who is able to get their Firebase Auth ID token (again, not terribly difficult for determined attacker), can fully create and write any document in the database. If you say there is no Auth at all in your app, then this is not really an issue, but if your project is configured to allow any form of authentication, it would be possible for an attacker to start writing anything.

You will get email from Firebase saying that your rules are not secure, mostly because you're allowing everyone to read everything.

What you should do is define more specifically what your security requirements are, then translate those into rules that actually meet those requirements. If you want to allow unauthenticated write access to your database of any kind, you are in a bit of trouble, as there is no way to make sure that the access actually matches the download behavior you're trying to measure. You'll be better off counting the downloads in whatever process manages the download, which is probably going to require a more sophisticated backend than what you have now.

But if allowing public read/write access is indeed what you want to allow, you'll be better off by making your rules more specific. For example, you can limit which collection the anonymous user can write to, and making sure they can only ever increment the counter, if these are the things you want.

回答2:

Confirming if a method is secure will depend a lot on your usage and the public you are aiming to reach. I would say that if the only thing you will be "providing" is wallpaper to download and no data will be inserted on your system, it's secure to use this method of security - having at least a login to admin and control your portal.

Let me know if the information helped you!

来源：https://stackoverflow.com/questions/60252601/cloud-firestore-rules-allowing-anybody-to-update-one-specific-field-in-a-docum