Cant get Firebase Storage security rules to refuse access to a file

做~自己de王妃 提交于 2021-02-16 18:50:08

问题


I'm sure I'm missing something wrt Firebase Storage rules, but I've done the following:

STEP 1

Firstly I set the following Firebase Storage rule:

service firebase.storage {
  match /b/{bucket}/o {
    match /items/{dev_key}/{perm_id}/{file_name} {
      allow write: if request.auth.uid == dev_id;
      allow read: if request.auth.token.permId == perm_id;
    }
  }
}

I expected only signed in users with a custom claim permId matching the relevant location to be able to download the file, allow read: if request.auth.token.permId == perm_id;.

So, I then set a custom claim in Cloud Functions on a user as follows:

STEP 2

    admin.auth().setCustomUserClaims(uid, {permId: '1'}).then(() => {
        // send off some triggers to let user know the download is coming
        admin.database().ref(`collection/${uid}/${itemId}`).update({
            downloadReady: true
        });
    });

Then I signed the user out and signed back in again... which set the custom claims. I checked that they were set in Cloud Functions as follows:

STEP 3

admin.auth().verifyIdToken(idToken).then((claims) => {
       console.log("--------------claims -------------");
       console.log(JSON.stringify(claims));
    });

And I saw in the claims string... permID: "1"

On the client side I then requested a downloadURL (here is hopefully where I'm going wrong)... I expected this to not be the public download url but rather the download url that the Firebase Storage security rules will check:

STEP 4

var pathReference = storage.ref('items/<some-key>/1/Item-1');

pathReference.getDownloadURL()
.then((url)=>{
    console.log("url: ", url);
})

The url I received from this call gave me this link https://firebasestorage.googleapis.com/v0/b/emiru84-games.appspot.com/o/games%2FcfaoVuEdJqOWDi9oeaLLphXl0E82%2F1%2FGame-1?alt=media&token=45653143-924a-4a7e-b51d-00774d8986a0 (a tiny little image I use for testing)

So far so good, the user with the correct claim was able to view this image

I then repeated step 2, logout/login again, except this time with a permId of "0". I expected the url generated previously to no longer work since my user no longer had the correct custom claim... and the bucket location was still at the same location (bucket/dev_key/1/filename) but it still worked.

If I repeated step 4 I got a new url, which then gave the appropriate 403 error response. However the old url still worked (I guess as long as the token parameter is tacked on). Is this expected, if so, I'm not sure I understand how the Storage security rules make a difference if the download url is public anyway?

Any help clearing my foggy brain would be appreciated.


回答1:


The download URL in Cloud Storage for Firebase is always publicly readable. It is not affected by security rules.

If you don't want to allow public access to a file, you can revoke its download URL.



来源:https://stackoverflow.com/questions/47653021/cant-get-firebase-storage-security-rules-to-refuse-access-to-a-file

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!