Firebasetechnicalvulnerabilities

Firebase Firestore: why 'allow read, write: if request.auth != null' is not security

Name: CleanIssue
Price range: €€

Published on 2026-03-256 min readCleanIssue

> TL;DR: The basic Firestore authentication rule doesn't protect your data. Here's why and how to fix it.

The false sense of security

The rule allow read, write: if request.auth != null is the most common Firestore configuration. It seems secure. In reality, it allows ANY authenticated user to read and modify ALL other users' data.

The fix

Replace with: allow read, write: if request.auth.uid == resource.data.userId

What we find

70% of Firebase applications we audit use this basic rule.

Key Takeaways

Identify and test your exposed attack surfaces before a third party does.

Client-side security controls never replace server-side validation.

Regular audits are more effective than one-time checks — vulnerabilities appear with every deployment.

Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

Three adjacent analyses to keep exploring the same attack surface.

technicalauthentication

Password reset: the 7 mistakes that open up your accounts

The "forgot password" flow is attackers' favorite way into SaaS accounts: predictable tokens, links that never expire, host header injection. The 7 mistakes we find most often in audits.

2026-06-26 · 7 min read

WordPresstechnical