Secure your Firebase application with these essential practices. From Security Rules to proper authentication.
Verify your app follows these best practices automatically.
Firebase provides flexible security through Security Rules, but misconfiguration is common. These practices help you secure your Firebase resources properly.
Never use 'allow read, write: if true;' in production. Every rule should validate authentication and authorization.
Write rules that check auth.uid and resource ownership for each operation
match /users/{userId} {
allow read, write: if true; // Anyone can access
}match /users/{userId} {
allow read, write: if request.auth != null
&& request.auth.uid == userId;
}Firebase API keys are designed to be public, but you should restrict them to your domains and enable only needed APIs.
In Google Cloud Console, restrict API key to your domain and specific Firebase APIs
Check data types, sizes, and required fields in Security Rules, not just authentication.
Add validation rules like request.resource.data.title.size() < 100
Firebase Auth integrates with Security Rules via request.auth. Custom auth loses this integration.
Use Firebase Auth SDK, reference request.auth in Security Rules
Storage buckets need their own Security Rules. Default rules are often too permissive.
Write Storage Rules that validate file types, sizes, and user ownership
App Check verifies requests come from your legitimate app, preventing API abuse.
Enable App Check in Firebase Console and enforce in Security Rules
Allows anyone to read and write any data
Always require authentication and ownership verification
Allows abuse from any domain, increasing costs and risk
Restrict API keys to your domains in Google Cloud Console
Allows malformed or malicious data to be stored
Add size limits, type checks, and required field validation in rules
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Scan Your App FreeNo, Firebase API keys are designed to be public. Security is enforced by Security Rules and API key restrictions. Never rely on hiding the API key for security.
Use the Firebase Rules Simulator in the Console, or write unit tests with @firebase/rules-unit-testing. Test both allowed and denied scenarios.
Only if your Security Rules allow it. With proper rules, the API key alone cannot access any data - authentication and authorization are still required.
Last updated: January 2026