0

I want to make a rules in my firebase storage, and I want the filename of image stored in firebase storage contains uid of its uploader. usually in programming language I use .contains to check

service firebase.storage {
  match /b/{bucket}/o {

    match /eventThumbnail/{imageID} {
      allow create: if request.resource.name.contains(request.auth.uid)
    }
  }
}

is this rules valid ? I can't find documentation about using contains in firebase storage security rules documentation. actually the rules is more complex, I still search what makes I fail to create an image, and I suspect that rules is not valid

Alexa289
  • 8,089
  • 10
  • 74
  • 178
  • How about storing the files of a user in a path segment/folder that is named after thir UID, as shown [here](https://firebase.google.com/docs/storage/security/user-security#user_private)? – Frank van Puffelen Jan 02 '20 at 14:46

3 Answers3

1

The API documentation for security rules for Cloud Storage is here. The specific documentation for string type objects is here. You can see that in the documentation, there is no "contains" method for string. But there is a method for using a regular expression to verify the contents of a string using matches().

However, I think Frank is correct in his comment suggesting that it would be better to use a dedicated prefix for each user using their UID in the path of the file. For example "/eventThumbnail/{uid}/{file}" could be used to determine the permissions for any file organized under uid, where uid could simply be verified as equal to request.auth.uid (no substrings or regular expression required). This is also far more secure and reliable than checking file substrings.

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
1

You can use something like this:

match /{fileName} {
  allow read: if fileName[0:6] == 'abcdef';
}

Documentation on string rules: https://firebase.google.com/docs/reference/security/storage#string

August Kimo
  • 1,503
  • 8
  • 17
0

Filename can now be used as UID and matched using Firebase storage split syntax found here.

I do also recommend rather using the path to prefix each UID instead, but if the files are already in a production environment the split syntax could prove useful.

Update: Syntax on Firebase Documentation appears to be incorrect as indicated by this post

Dylan Crombie
  • 11
  • 4