Get a $149 diagnosis

Error library

Symptom: Firestore permission denied by Security Rules

Firestore denies client requests that your Security Rules don't explicitly allow, and locked-mode or expired test-mode rules deny everything. Write rules that allow each operation for the right signed-in user and test them in the Rules Playground.

Cause: Security Rules don't allow this read/write for this user, or test-mode rules expired.

How to fix it

  1. Check the rules in the Firebase console; test-mode rules expire after a date.
  2. Write rules per collection that check request.auth.uid.
  3. Make sure the user is signed in before the query runs.
  4. Test with the Rules Playground or emulator before deploying.

Example

Illustrative example, not from a customer project.

  match /todos/{id} {
-   allow read, write: if false;
+   allow read, write: if request.auth != null && request.auth.uid == resource.data.uid;
  }

FAQ

It worked last month and suddenly stopped.

Test-mode rules include an expiry date.

Should I allow everything?

No. Open rules let anyone read or modify your data.

Get a $149 diagnosis See pricing Still exposed or still logged out? Get an auth & database security fix (Supabase, Firebase).

$149Get a $149 diagnosis