Skip to main content

Learn Security Rules

Security Rules Language​

Security Rules are based on a flexible and powerful custom language, capable of supporting permission controls of varying complexity and granularity. Developers can set specific or general rules according to the specific needs of their applications. Security Rules use a JSON structure, in which:

  • key refers to the operation type (such as read, write, etc.)
  • value is the condition for allowing operations, which can be:
    • A simple boolean value (true/false)
    • An expression string similar to JavaScript

An expression can be a single logical expression or multiple expressions combined with AND/OR logic. The system determines whether to allow the operation based on the evaluation result of the expression.

Since Security Rules are a specially designed language, they may require some learning time. This guide will help you understand the basics of the rules language, laying the foundation for writing more complex rules later.

Basic Structure and Syntax​

Security Rules are based on a JSON structure, where value can be a boolean or a JavaScript-like expression:

{
    "read": true,
    "write": <<condition>>,
    "create": true,
    "update": false,
    "delete": <<condition>>
}

Which contains several key concepts

  • Operation Type: The JSON key represents the operation type supporting permission control. create, delete, read, and update correspond to the create, delete, read, and update operations on a collection. write is a simplified configuration for controlling write permissions on a collection. If create, delete, and update operations are not configured, the system will follow the write configuration.
  • Rule: The JSON value serves as the rule condition, which can be a boolean value or a logical expression (group). When the condition evaluates to true, it indicates that the operation is permitted.

By default, encountering an undefined operation type results in denial of access to that operation.

Condition Construction​

Conditions can be either boolean values or expression strings. The expression string syntax resembles Javascript, which may be a single logical expression or multiple logical expressions combined using AND/OR operators. The evaluation result of the expression determines whether the operation is permitted.

Predefined Variables​

VariableTypeDescription
nownumberCurrent timestamp, indicating the number of milliseconds since the Linux epoch
authAuthUser login information, containing uid (unique user ID) and loginType (login type); becomes null when not logged in
docObjectThe record object for the current operation. When referenced, it will be read once from the service, and this query will be counted against relevant resource quotas.
requestRequestThe request object, containing various request-related information
Auth​
Field NameTypeDescription
loginTypestringlogin method, such as public platform login, open platform login, custom login, anonymous login, etc.
uidstringUser unique identifier ID. Note: This value is not included in WeChat Mini Program requests.
openidstringUser's WeChat openid, only exists in WeChat-related login methods
LoginType Enum Values​
Enum ValueSign-in Method
WECHAT_PUBLICWeChat Official Account
WECHAT_OPENWeChat Open Platform
docObject
EMAILEmail Login
CUSTOMCustom Login
Request​
Field NameTypeDescription
dataobjectData object passed in the request, present only for create and update operation types.

Variables can be used in rule expressions. Through doc and request.data, the current value of the data and the value passed in the request can be obtained. For example, in an order collection, to prevent order amounts from being tampered with, the following rule can be used:

{
    // ... other rules ... //
    "update": "doc.price == request.data.price || request.data.price == undefined"
    // ... other rules ... //
}

This rule ensures that either the request does not modify the price field, or the modified price remains the same as the original price.

Built-in Methods​

Currently, only the get function is supported. This function accepts one parameter, and the format must be database.collection_name.document_id. Through this function, you can access data from other documents to determine whether the current operation complies with security rules.

For example, check whether the user has permission to modify specific documents:

{
    "update": "get(`database.users.${auth.uid}`).role == 'admin'"
}

Operators​

OperatorDescriptionExampleMeaning Description
==Equal toauth.uid == 'zzz'User's uid equals 'zzz'
!=Not equal toauth.uid != 'zzz'User's uid is not equal to 'zzz'
>Greater thana>10The value of variable a is greater than 10
>=Greater than or equal toa>=10The value of variable a is greater than or equal to 10
<Less thana<10The value of variable a is less than 10
<=Less than or equal toa<=10The value of variable a is less than or equal to 10
inIn setauth.uid in ['zzz','aaa']User's uid is one of the values in ['zzz','aaa']
!(xx in [])Not in set!(auth.uid in ['zzz','aaa'])User's uid is not in the set ['zzz','aaa']
&&Logical ANDauth.uid == 'zzz' && a>10User's uid equals 'zzz' and the value of a is greater than 10
||Logical ORauth.uid == 'zzz' || a>10User's uid is 'zzz' or the value of a is greater than 10
.Object property accessorauth.uidAccess the uid property of the auth object
[]Object property or array element accessa[auth.uid] == 'zzz'The value of the property in object a with the key being the user's uid equals 'zzz'.