Client access to Firestore is controlled by Security Rules — a declarative rule language, written and deployed separately from your application code, that Firestore evaluates against every read or write request from a client SDK.
- Rules can check the requesting user's authentication state, compare fields in the incoming write against existing document data, and reference other documents, all without a custom backend in the middle
- Server-side access through the Admin SDK bypasses Security Rules entirely and is instead governed by Google Cloud IAM roles on the underlying service account
- Data is encrypted at rest and in transit by default; there's no separate configuration step required to enable that baseline encryption
Because Security Rules are the only access control for client SDK traffic, they need to be tested as carefully as backend authorization code — a permissive rule is directly exploitable from any client.
Use cases
Security governance examples
- Define read/write rules per collection
- Enforce owner access to documents
- Log changes for compliance
- Integrate with IAM policies
- Audit rule evaluations