Firebase Security Rules

In detail

Firebase Security Rules are the primary data access layer for Firebase apps. Because the Firebase SDKs allow client side code to read and write directly to the database, rules are the only thing preventing a malicious client from accessing data it should not. Developers write rules in a domain specific language, and the server evaluates them for every request. A common misconfiguration is rules that allow read and write to all documents by any authenticated user (or, more dangerously, by anyone at all). Firebase's default rules in some SDK versions have historically allowed open access until explicitly locked down.