Firestore request failed because security rules denied it

What it means in plain English

The browser is using the Firestore client, and the rules for that document said no. Firebase's rules guide says every request from a mobile or web client library is evaluated before any data is read or written. If the rules deny any of the document paths in the request, the entire request fails.

The server client libraries are different. Firebase says they bypass Firestore security rules and use Google credentials instead. A denial you only see in the browser is a rules problem, not a bad database URL.

Likely causes

• The default rules still deny every read and write. Firebase shows that set as allow read, write: if false.
• The rules require request.auth != null, and the page never signed the person in.
• The query touches a document the match path does not allow, so the whole query fails.
• Rules were edited in the repo and never deployed, or the console rules were overwritten by firebase deploy.

How to fix it, step by step

1. Open the rules that are actually deployed. Firebase says the console path for the default database is Databases & Storage, then Firestore, then Rules. The Google Cloud console can edit rules for additional databases, and Firebase says it does not deploy rules to the (default) database.
2. Write a match for the path the app uses, with an allow that matches the signed-in user. Firebase's signed-in example is allow read, write: if request.auth != null on /{document=**}. Do not ship allow read, write: if true. Firebase says that lets anyone overwrite the database.
3. Test in the Rules Playground before you publish. Firebase says the playground runs against the rules in the editor, not the deployed rules. Then click Publish. Firebase says an update can take up to a minute for new queries, and up to 10 minutes for listeners that are already running.
4. If you keep rules in the repo, deploy them with firebase deploy --only firestore. Firebase warns that a CLI deploy overwrites the rules currently in the console.

How to check it worked

• The same read or write succeeds for a signed-in user and still fails for a signed-out one, if that is what the rule says.
• The Rules Playground shows the request as allowed for the token you expect.

How that denial compares with a Supabase query that returns an empty list is in Supabase vs Firebase.

Sources

• https://firebase.google.com/docs/firestore/security/get-started (opens in a new tab)