I am confused whether firebase storage is safe as I was building notes app for my institution and I secured my storage to allow only read for authenticated users. Despite doing this I noticed that there was a link when I opened that link on incognito so I was able to view my file how??? Incognito, I was not signed in…
I followed a link given in storage (firebase) of a file that I had uploaded and I was surprised when I was able to access it in incognito. I had also set up rules denied clearly for users who were not authenticated.
SUDEEP KUMAR SINGH is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
My guess is that you’ve found a so-called download URL, which is a URL that provides public, read-only access to the file. So this URL (intentionally) bypasses the security rules you set.
If you uploaded the file through the Firebase console, such a download URL is auto-generated. You can revoke it from the Firebase console too by clicking the Revoke link next to the Access token label for the file.
If you’re uploading files through the API, no automatic download URL is generated for the file. In that case it is important that you don’t generate a download URL yourself from your code anywhere (by calling an API getDownloadURL).