安全规则语言

Firebase Security Rules leverage flexible, powerful, custom languages that support a wide range of complexity and granularity. You can make your Security Rules as specific or as general as makes sense for your app. Realtime Database rules use a syntax that looks like JavaScript in a JSON structure. Cloud Firestore and Cloud Storage rules use a language based on the Common Expression Language (CEL), that builds on CEL with match and allow statements that support conditionally granted access.

Because these are custom languages, however, there is a learning curve. Use this guide to better understand the Security Rules language as you dive deeper into more complex rules.

Select a product to learn more about its rules.

Basic structure

Cloud Firestore

Firebase Security Rules in Cloud Firestore and Cloud Storage use the following structure and syntax:

service <<name>> {
  // Match the resource path.
  match <<path>> {
    // Allow the request if the following conditions are true.
    allow <<methods>> : if <<condition>>
  }
}

The following key concepts are important to understand as you build the rules:

• Request: The method or methods invoked in the allow statement. These are methods you‘re allowing to run. The standard methods are: get, list, create, update, and delete. The read and write convenience methods enable broad read and write access on the specified database or storage path.
• Path: The database or storage location, represented as a URI path.
• Rule: The allow statement, which includes a condition that permits a request if it evaluates to true.

Each of these concepts is described in further detail below.