So, I’ve built a Flutter app that uses Firebase for chat message storage and Firebase Cloud Messaging (FCM) to send messages to logged-in users. During development, I’ve encountered a situation where a particular user keeps logging in and sending irrelevant messages. I have access to their device token. I need a way to prevent this user from logging in, reading messages, and sending new messages without affecting other users’ access. I tried adjusting Firestore security rules, but this impacted all devices’ ability to log in.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.auth != null && request.auth.token.device_token != 'f25oOjQLS2mosRuCIUy2VM:APA91bEGHMhGHtKkA8GIQwE9EI96k0oTSzvCcM1qfrcEhMhsOGUw3R_cq7pyP7u3ru5hf9sVAKXbdMYJxJhajTeF0rG_5THBKQlnsx2_kfiDihUSWngQqY2Uf74RzVQDPnycnJYKwqv2';
}
}
}
I want to block this user from accessing my app.
There is no implicit connection between a Firebase Authentication user and the FCM tokens of the device(s) where they use your app. If you need such a connection for your use-case, you will have to associate them yourself.
For example, you could add the FCM token(s) to the user’s Authentication profile as custom claims, as shown in the documentation on controlling access with Custom Claims and Security Rules.