Restricting Cloud Firestore to a specific domain
Is there a way to restrict Cloud Firestore (for hosting/web) to do CRUD operations with restrictions to one domain only, say xyz.com?
For example, the rule below locks read, update, delete without authorisation but you can still write things to the database.
service cloud.firestore {
match /databases/{database}/documents {
match /coming-soon-email-ids/{document=**} {
allow write;
allow read, update, delete: if request.auth.uid == !null;
}
}
}
Or do I have to integrate Google's firewall in it?
firebase google-cloud-firestore firebase-security-rules
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
add a comment |
Is there a way to restrict Cloud Firestore (for hosting/web) to do CRUD operations with restrictions to one domain only, say xyz.com?
For example, the rule below locks read, update, delete without authorisation but you can still write things to the database.
service cloud.firestore {
match /databases/{database}/documents {
match /coming-soon-email-ids/{document=**} {
allow write;
allow read, update, delete: if request.auth.uid == !null;
}
}
}
Or do I have to integrate Google's firewall in it?
firebase google-cloud-firestore firebase-security-rules
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01
add a comment |
Is there a way to restrict Cloud Firestore (for hosting/web) to do CRUD operations with restrictions to one domain only, say xyz.com?
For example, the rule below locks read, update, delete without authorisation but you can still write things to the database.
service cloud.firestore {
match /databases/{database}/documents {
match /coming-soon-email-ids/{document=**} {
allow write;
allow read, update, delete: if request.auth.uid == !null;
}
}
}
Or do I have to integrate Google's firewall in it?
firebase google-cloud-firestore firebase-security-rules
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
Is there a way to restrict Cloud Firestore (for hosting/web) to do CRUD operations with restrictions to one domain only, say xyz.com?
For example, the rule below locks read, update, delete without authorisation but you can still write things to the database.
service cloud.firestore {
match /databases/{database}/documents {
match /coming-soon-email-ids/{document=**} {
allow write;
allow read, update, delete: if request.auth.uid == !null;
}
}
}
Or do I have to integrate Google's firewall in it?
firebase google-cloud-firestore firebase-security-rules
firebase google-cloud-firestore firebase-security-rules
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
edited Nov 22 '18 at 7:28
Doug Stevenson
77.3k990111
77.3k990111
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
asked Nov 22 '18 at 7:11
AkshayAkshay
7721931
7721931
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01
add a comment |
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01
add a comment |
1 Answer
1
active
oldest
votes
Firebase security rules aren't able to restrict access to a web domain. In a very general sense, it is not possible, because Firestore is intended to be accessed from mobile clients around the world, using web, Android, and iOS. Android and iOS clients never appear to be coming from some domain. They just directly access the database via the provided client library, or sometimes through the Firestore REST API. Web clients may even spoof their apparent domain (which is only really available by the insecure "Referrer" header in an HTTP request).
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53425585%2frestricting-cloud-firestore-to-a-specific-domain%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Firebase security rules aren't able to restrict access to a web domain. In a very general sense, it is not possible, because Firestore is intended to be accessed from mobile clients around the world, using web, Android, and iOS. Android and iOS clients never appear to be coming from some domain. They just directly access the database via the provided client library, or sometimes through the Firestore REST API. Web clients may even spoof their apparent domain (which is only really available by the insecure "Referrer" header in an HTTP request).
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
add a comment |
Firebase security rules aren't able to restrict access to a web domain. In a very general sense, it is not possible, because Firestore is intended to be accessed from mobile clients around the world, using web, Android, and iOS. Android and iOS clients never appear to be coming from some domain. They just directly access the database via the provided client library, or sometimes through the Firestore REST API. Web clients may even spoof their apparent domain (which is only really available by the insecure "Referrer" header in an HTTP request).
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
add a comment |
Firebase security rules aren't able to restrict access to a web domain. In a very general sense, it is not possible, because Firestore is intended to be accessed from mobile clients around the world, using web, Android, and iOS. Android and iOS clients never appear to be coming from some domain. They just directly access the database via the provided client library, or sometimes through the Firestore REST API. Web clients may even spoof their apparent domain (which is only really available by the insecure "Referrer" header in an HTTP request).
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
Firebase security rules aren't able to restrict access to a web domain. In a very general sense, it is not possible, because Firestore is intended to be accessed from mobile clients around the world, using web, Android, and iOS. Android and iOS clients never appear to be coming from some domain. They just directly access the database via the provided client library, or sometimes through the Firestore REST API. Web clients may even spoof their apparent domain (which is only really available by the insecure "Referrer" header in an HTTP request).
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
answered Nov 22 '18 at 7:28
Doug StevensonDoug Stevenson
77.3k990111
77.3k990111
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
add a comment |
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
Ok is there a way to restric to one or more fields?
– Akshay
Nov 23 '18 at 5:47
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
I don't know what you're asking. It sounds like the beginning of a whole new question that's unrelated to this one.
– Doug Stevenson
Nov 23 '18 at 5:55
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
True. Will post a new one thanks.
– Akshay
Nov 23 '18 at 7:46
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
If logged in via google (G suit for instance) I think we simply check for the email domain in the firestore rules
– TheeBen
Jan 31 at 5:59
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
blog.jimmycai.com/p/firebase-limit-access-to-certain-domains
– TheeBen
Jan 31 at 6:01
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53425585%2frestricting-cloud-firestore-to-a-specific-domain%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
check this out blog.jimmycai.com/p/firebase-limit-access-to-certain-domains. Not quite a domain restriction but for google's login you could restrict to a certain domain for G suit
– TheeBen
Jan 31 at 6:01