Firebase Cloud Storage Security Rules 2

Apply these rules to Security Rules language v2 for Cloud Storage for Firebase. They cover object access through Firebase clients and the separate IAM, download-token, and signed-URL paths that can bypass those rules.

Rulesets and buckets

• Start with rules_version = '2';, declare service firebase.storage, and match objects under /b/{bucket}/o.
• Deploy the intended rules to every application bucket in the intended Firebase project. Review bucket targets and rule-file mappings rather than assuming a default bucket covers them all.
• Start with no client grants and add only the required object operations. Remove test-mode and temporary open-access rules before storing real data.
• Treat bucket creation, public-access configuration, IAM, and rule deployment as privileged operations; ordinary upload users must not control those settings.
• Review shared default buckets such as *.appspot.com for App Engine and other service data before adding a broad Firebase grant.
• Keep the tested rule file in source control and deploy it through the configured release path. A local or uploaded ruleset is not evidence that the production bucket is using it.

Authentication and ownership

• Require request.auth != null before reading UID or token claims, and authorize the exact path and operation for request.auth.uid.
• Bind user or tenant path components to a trusted identity or protected membership record. A filename, folder prefix, or supplied metadata field is not authentication.
• Treat anonymous Firebase Authentication accounts as authenticated accounts; require a