Firebase rule only checks sign-in
Scan rule · RSC-SEC-132
- Security
- Severity: High
- CWE-639
- OWASP A01-2021
Finds Firebase rules that only require `request.auth != null` (or `auth != null`) without reference to the owner, `resource.data` or `request.auth.uid` — anywhere in Firestore and the Realtime Database, on user paths in Storage.
Why this matters
“Signed-in users only” sounds like protection, but on Firebase it barely is: anyone creates an account in seconds, via email, Google or often even anonymously. A rule that only checks WHETHER someone is signed in lets every account read or overwrite everyone else's data.
From the outside this is invisible — anonymously the database correctly denies access. That makes it the Firebase counterpart to the Supabase policy that only checks `auth.role() = 'authenticated'`. Fix: bind every rule to the owner and cross-check in the rules playground with two different accounts.
Scan tier
- Repo access (deep scan)
How to fix it
Bind access to the owner, e.g. `request.auth.uid == resource.data.ownerId`, or on user paths `request.auth.uid == userId`.