以下是我们在 I/O 大会上宣布的所有内容，从新的 Firebase Studio 功能到集成 AI 的更多方式，内容非常丰富。
阅读博客。
Firebase 安全规则使用入门
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
Firebase Security Rules 让您能够以完全自定义的方式可靠地保护 Cloud Firestore、Realtime Database 和 Cloud Storage 中的数据。您可以按照本指南中的步骤轻松开始使用 Rules，确保数据安全，并保护您的应用免受恶意用户攻击。
了解 Firebase Security Rules 语言
在您开始编写规则之前，值得花一些时间查看您正在使用的 Firebase 产品的特定 Firebase Security Rules 语言。Realtime Database 在其Rules中使用类似 JavaScript 的语法和 JSON 结构。而 Cloud Firestore 和 Cloud Storage 则利用通用表达式语言 (CEL) 的超集，该语言依赖于 match 和 allow 语句设置访问特定路径的条件。
详细了解 Firebase Security Rules 语言。
设置 Authentication
如果您尚未执行此操作，请使用 Firebase Authentication 识别您的用户。
Firebase Authentication 支持多种常见的身份验证方法，并且与 Firebase Security Rules 集成，从而提供全面的验证功能。
您可以为您的应用设置其他自定义身份验证信息。
详细了解 Firebase Security Rules 和 Firebase Authentication。
定义您的数据和规则结构
您构建数据的方式可能会影响您构建和实现规则的方式。在您定义数据结构时，请考虑它们对 Rules 结构可能产生的影响。
例如，在 Cloud Firestore 中，您可能希望包含一个表示每个用户的特定角色的字段。然后，您的规则可以读取该字段并使用它来授予基于角色的访问权限。
在定义数据和规则架构时，请记住，如果任何规则授予对数据集的访问权限，Firebase Security Rules将授予对该数据集的访问权限。换句话说，如果您已经在数据结构的更高层次授予了访问权限，则无法在子路径中对访问权限进行细化。
访问您的规则
如需查看现有的 Rules，请使用 Firebase CLI 或 Firebase 控制台。确保始终使用同一方法修改您的规则，以避免错误地覆盖更新。如果您不能确定本地定义的规则是否反映了最近的更新，Firebase 控制台中会始终显示最近部署的 Firebase Security Rules 版本。
如需从 Firebase 控制台访问您的规则，请选择您的项目，然后导航到 Realtime Database、Cloud Firestore 或 Storage。您进入正确的数据库或存储分区之后，请点击规则。
如需从 Firebase CLI 访问您的规则，请打开 firebase.json 文件中记录的规则文件。
编写基本规则
在您开发应用和了解 Rules 时，请尝试实现几项基本的安全规则，包括以下用例：
- 仅限内容所有者：限制用户对内容的访问。
- 混合访问：限制用户的写入权限，但允许公开读取。
- 基于属性的访问：仅限一组用户或一种类型的用户访问。
测试您的规则
如需完全验证您的应用的行为，并验证您的 Firebase Security Rules
配置，请使用 Firebase 模拟器在本地环境中运行单元测试并使之自动化。
如果您在 Firebase 控制台中设置 Firebase Security Rules，则可以使用 Firebase 规则模拟器快速验证行为。但是，在您将更改部署到生产环境之前，我们建议您使用 Firebase 模拟器进行更全面的测试。
部署规则
使用 Firebase 控制台或 Firebase CLI 将您的规则部署到生产环境中。按照管理和部署 Firebase Security Rules 中介绍的步骤进行操作。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[],[],null,["\u003cbr /\u003e\n\nFirebase Security Rules provide robust, completely customizable protection for your data in\nCloud Firestore, Realtime Database, and Cloud Storage. You can easily get\nstarted with Rules following the steps in this guide, securing your\ndata and protecting your app from malicious users.\n\nUnderstand the Firebase Security Rules language\n\nBefore you start writing rules, it's worthwhile to take some time to review\nthe specific Firebase Security Rules language for the Firebase products you're using.\nRealtime Database leverages a JavaScript-like syntax and JSON structure for its\nRules. Alternately, Cloud Firestore and Cloud Storage leverage a superset\nof the Common Expression Language (CEL) that relies on `match` and `allow`\nstatements that set a condition for access at a defined path.\n\nLearn more about the [Firebase Security Rules language](/docs/rules/rules-language).\n\nSet up Authentication\n\nIf you haven't done it already, identify your users with [Firebase Authentication](/docs/auth).\nFirebase Authentication supports many common authentication methods and integrates with\nFirebase Security Rules to provide comprehensive verification capabilities.\n\nYou can set up additional, custom authentication information for your app.\n\nLearn more about [Firebase Security Rules and Firebase Authentication](/docs/rules/rules-and-auth).\n\nDefine your data and rules structures\n\nThe way you structure your data might affect the way you structure and\nimplement your rules. As you define your data structures, consider the\nimplications they might have on your Rules structure.\n\nFor example, in Cloud Firestore, you might want to include a field that denotes\na specific role for each user. Then, your rules can read that field and use it\nto grant role-based access.\n\nAs you define your data and rules architectures, keep in mind that, if *any*\nrule grants access to a dataset, Firebase Security Rules grants access to that dataset. In\nother words, you can't refine access at a subpath if you've granted access at\na higher level in your data hierarchy.\n\nAccess your rules\n\nTo view your existing Rules, use either the Firebase CLI or the\nFirebase console. Make sure you edit your rules using the same method,\nconsistently, to avoid mistakenly overwriting updates. If you're not sure\nwhether your locally defined rules reflect the most recent updates, the Firebase\nconsole always shows the most recently deployed version of your Firebase Security Rules.\n\nTo access your rules from the [Firebase console](//console.firebase.google.com/), select your\nproject, then navigate to **Realtime Database** , **Cloud Firestore** or\n**Storage** . Click **Rules** once you're in the correct database or storage\nbucket.\n\nTo access your rules from the Firebase CLI, go to the\nrules file noted in your [firebase.json file](/docs/cli#the_firebasejson_file).\n\nWrite basic rules\n\nAs you're developing your app and understanding Rules, try\nimplementing a few [basic Security Rules](/docs/rules/basics), including the following\nuse cases:\n\n- **Content-owner only:** Restrict access to content by user.\n- **Mixed access:** Restrict write access by user, but allow public read access.\n- **Attribute-based access:** Restrict access to a group or type of user.\n\nTest your rules\n\nTo fully validate your app's behavior and verify your Firebase Security Rules \n\nconfigurations, use the [Firebase Emulator](/docs/rules/emulator-setup) to run and automate unit\ntests in a local environment.\n\nIf you're setting up your Firebase Security Rules in the Firebase console, you can use\nthe [Firebase Rules Simulator](/docs/rules/simulator) to quickly validate behavior. However, we\nrecommend more thorough testing with the Firebase Emulator before you deploy your\nchanges to production.\n\nDeploy rules\n\nUse the Firebase console or the Firebase CLI to deploy your rules\nto production. Follow the steps outlined in\n[Manage and deploy Firebase Security Rules](/docs/rules/manage-deploy)."]]
