開始使用 Firebase 安全性規則
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
Firebase Security Rules為 Cloud Firestore、Realtime Database 和 Cloud Storage 中的資料提供強大且完全可自訂的保護措施。請按照本指南中的步驟操作，輕鬆開始使用 Rules，確保資料安全無虞，並保護應用程式免於惡意使用者侵擾。
瞭解 Firebase Security Rules 種語言
開始編寫規則前，請花點時間查看所用 Firebase 產品的特定 Firebase Security Rules 語言。Cloud Storage 採用一般運算語言 (CEL) 的超集，並依據 match 和 allow 陳述式，在定義的路徑中設定存取條件。
首先，請學習 Firebase Security Rules 語言的核心語法。
設定「Authentication」
如果尚未完成，請將 Firebase Authentication 新增至應用程式。Firebase Authentication 支援許多常見的驗證方法，並與 Firebase Security Rules 整合，提供全面的驗證功能。
您可以為應用程式設定額外的自訂驗證資訊。
進一步瞭解 Firebase Security Rules 和 Firebase Authentication。
定義資料和規則結構
資料結構可能會影響規則的結構和實作方式。定義資料結構時，請考量這些結構對 Rules 結構可能造成的影響。
舉例來說，在 Cloud Storage 中，您可能想加入一個欄位，指出每位使用者的特定角色。然後，規則可以讀取該欄位，並用來授予角色型存取權。您也可以建立Cloud Firestore資料庫，將存取條件儲存在Cloud Firestore文件中，然後從 Cloud Storage Security Rules 存取這些文件。
定義資料和規則架構時，請注意規則的連鎖方式 (視產品而定)。使用 Realtime Database 時，規則會由上而下運作，較淺的規則會覆寫較深的規則。如果規則在特定路徑授予讀取或寫入權限，也會授予該路徑下所有子節點的存取權。相較之下，Cloud Firestore 和 Cloud Storage 的規則只會套用至資料階層的指定層級，您必須編寫明確的規則，才能控管不同層級的存取權。
存取規則
如要查看現有的 Rules，請使用 Firebase CLI 或 Firebase 控制台。請務必使用相同方法編輯規則，以免不小心覆寫更新。如果不確定本機定義的規則是否反映最新更新，Firebase 控制台一律會顯示最近部署的 Firebase Security Rules 版本。
如要從 Firebase 控制台存取規則，請選取專案，然後在左側導覽面板中按一下「Storage」。進入正確的資料庫或儲存空間 bucket 後，按一下 Rules。
如要透過 Firebase CLI 存取規則，請前往firebase.json 檔案中註明的規則檔案。
撰寫基本規則
開發應用程式並瞭解 Rules 時，請嘗試導入 Rules 來解決幾個基本用途，包括：
- 僅限內容擁有者：限制使用者存取內容。
- 混合存取權：限制使用者的寫入權限，但允許公開讀取。
- 屬性存取權：限制特定群組或類型使用者的存取權。
測試規則
如果您在 Firebase 控制台中設定 Firebase Security Rules，可以使用 Firebase 規則遊樂場快速驗證行為。不過，建議您先使用 Local Emulator Suite 進行更徹底的測試，再將變更部署至正式環境。
部署規則
使用 Firebase 控制台或 Firebase CLI 將規則部署至正式環境。請按照「管理及部署 Firebase Security Rules」一文中的步驟操作。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nFirebase Security Rules provide robust, completely customizable protection for your data in\nCloud Firestore, Realtime Database, and Cloud Storage. You can easily get\nstarted with Rules following the steps in this guide, securing your\ndata and protecting your app from malicious users.\n\nUnderstand the Firebase Security Rules language\n\nBefore you start writing rules, it's worthwhile to take some time to review\nthe specific Firebase Security Rules language for the Firebase products you're using.\nCloud Storage leverages a superset\nof the Common Expression Language (CEL) that relies on `match` and `allow`\nstatements that set a condition for access at a defined path..\n\nStart by learning the [core syntax of the Firebase Security Rules language](/docs/storage/security/core-syntax).\n\nSet up Authentication\n\nIf you haven't done it already, add [Firebase Authentication to your app](/docs/auth).\nFirebase Authentication supports many common authentication methods and integrates with\nFirebase Security Rules to provide comprehensive verification capabilities.\n\nYou can set up additional, custom authentication information for your app.\n\nLearn more about [Firebase Security Rules and Firebase Authentication](/docs/rules/rules-and-auth).\n\nDefine your data and rules structures\n\nThe way you structure your data might affect the way you structure and\nimplement your rules. As you define your data structures, consider the\nimplications they might have on your Rules structure.\n\nFor example, in Cloud Storage, you might want to include\na field that denotes a specific role for each user. Then, your rules can read\nthat field and use it to grant role-based access. You can also create\na Cloud Firestore database, store access criteria in Cloud Firestore\ndocuments, then access those documents from Cloud Storage Security Rules.\n\nAs you define your data and rules architectures, keep in mind the way that\nrules cascade or don't cascade, depending on your product. With Realtime Database,\nrules work from top-down, with shallower rules overriding deeper rules. If a\nrule grants read or write permissions at a particular path, then it also grants\naccess to all child nodes under it. In contrast, with Cloud Firestore and\nCloud Storage, rules apply only at specified levels of the data hierarchy,\nand you write explicit rules to control access to different levels.\n\nAccess your rules\n\nTo view your existing Rules, use either the Firebase CLI or the\nFirebase console. Make sure you edit your rules using the same method,\nconsistently, to avoid mistakenly overwriting updates. If you're not sure\nwhether your locally defined rules reflect the most recent updates, the Firebase\nconsole always shows the most recently deployed version of your Firebase Security Rules.\n\nTo access your rules from the [Firebase console](//console.firebase.google.com/), select your\nproject, then in the left-hand navigation panel, click\n**Storage** . Click **Rules** once you're\nin the correct database or storage bucket.\n\nTo access your rules from the Firebase CLI, go to the\nrules file noted in your [firebase.json file](/docs/cli#the_firebasejson_file).\n\nWrite basic rules\n\nAs you're developing your app and understanding Rules, try\nimplementing Rules to address a few [basic use cases](/docs/rules/basics),\nincluding the following:\n\n- **Content-owner only:** Restrict access to content by user.\n- **Mixed access:** Restrict write access by user, but allow public read access.\n- **Attribute-based access:** Restrict access to a group or type of user.\n\nTest your rules\n\nIf you're setting up your Firebase Security Rules in the Firebase console, you can use\nthe [Firebase Rules Playground](/docs/rules/simulator) to quickly validate\nbehavior. However, we recommend more thorough testing with the\n[Local Emulator Suite](/docs/rules/emulator-setup) before you deploy your\nchanges to production.\n\nDeploy rules\n\nUse the Firebase console or the Firebase CLI to deploy your rules\nto production. Follow the steps outlined in\n[Manage and deploy Firebase Security Rules](/docs/rules/manage-deploy)."]]
