Firebase Storage Safety
This image link that is written as CH-1 E W F NI am confused whether firebase storage is safe as I was building notes app for my institution and I secured my storage to allow only read for authenticated users. Despite doing this I noticed that there was a link when I opened that link on incognito so I was able to view my file how??? Incognito, I was not signed in...
I followed a link given in storage (firebase) of a file that I had uploaded and I was surprised when I was able to access it in incognito. I had also set up rules denied clearly for users who were not authenticated.
My guess is that you've found a so-called download URL, which is a URL that provides public, read-only access to the file. So this URL (intentionally) bypasses the security rules you set.
If you uploaded the file through the Firebase console, such a download URL is auto-generated. You can revoke it from the Firebase console too by clicking the Revoke link next to the Access token label for the file.
If you're uploading files through the API, no automatic download URL is generated for the file. In that case it is important that you don't generate a download URL yourself from your code anywhere (by calling an API getDownloadURL).
- java.lang.IllegalAccessError: superclass access check failed: class org.jetbrains.kotlin.kapt3.base.javac.KaptJavaCompiler?
- Unable to add Firebase Performance Plugin for the new Android gradle project structure
- How to fix duplication error of GoogleUtilities Swift?
- Firebase Realtime Listener Concept - how to detach / unsubscribe from the listener?
- Google Firebase: How do I "work around" an invalid "issuer" value in my client's OIDC discovery document?
- Firebase Cloud Messaging - FirebaseMessaging.instance.getToken() throwing unknown error
- Firestore JSON parsing terminated
- Firebase cloud messaging HTTP v1 send error - 400 Client Error: Bad Request for url: https://fcm.googleapis.com/v1/projects/<PROJECT_ID>/messages:send
- Do subcollections avoid listener scaling problems that collections have?
- Error: Component auth has not been registered yet - React, NextJs, Firebase auth
- Firebase Storage Rules with Custom Claims
- How to ask for android user permission for Analytics on Flutter
- Firebase web Push notifications is triggered twice when using onBackgroundMessage()
- Firebase Phone Auth isn't sending SMS with code
- Understanding Firestore addSnapshotListener: Does It Return All Matching Documents or Only New Inserts?
- What is the raw format for a Firestore Timestamp
- Issues with Dependencies in Firebase App Hosting and Cloud Functions Deployments for Next.js App
- Firebase Cloud Functions cannot read nitro generated index.mjs file
- Flutter cloud_firestore Filter.or using DocumentReference throws Invalid argument error
- Unable to resolve host "www.googleapis.com":No address associated with hostname Android Studio Messanger Project
- type 'List<Object?>' is not a subtype of type 'PigeonUserDetails?' in type cast
- Is it possible to use Firebase for app user without Google account?
- Firebase Error: Auth error from APNS or Web Push Service
- Make sure to call FirebaseApp.initializeApp(Context) first.Default FirebaseApp is not initialized in this process
- Problem while using Firebase cloud functions in Unity: request data always empty
- The binary version of its metadata is 1.7.1, expected version is 1.5.1. How to Solve?
- Skipping write to Firestore if Anonymous user logic
- How to call await correctly?
- FCM Android Notification sound issue
- Put blank values in a form when I change the name of an input