1239 results found

1. Missing Primitives: Transaction Awareness and Trusted Server Metadata in Security Rules

   Firestore Security Rules currently lack two capabilities that force developers to choose between security, performance, and maintainability.

   1. Lack of Transaction/Batch Awareness Rules cannot verify if a write is part of an atomic batch or transaction. This makes it impossible to enforce multi-document integrity constraints natively.

   The Fallout: Developers must either trust the client to perform all parts of an operation (unsafe) or move logic to Cloud Functions. This introduces latency and cold-starts, but more importantly, it fragments security logic. Concise, native rules bolster security because they are easier to audit and are implemented correctly more often than fragmented, multi-layered workarounds.

   1. No "Middle Ground" for Server-Side Operations Currently, a server must either use the Admin SDK (which results in a full administrative bypass of all rules) or Identity Platform to impersonate a user. There is no way for a server to provide "partial validation" for a request that must still remain failable if it violates standard Rule constraints.

   The Fallout: Current limitations incentivize the use of "shared secrets"—checking for specific plain text properties or "magic strings" within the document data to signal that a server has "blessed" the write. This pattern may be adopted because it is more efficient than the alternatives, but it is brittle and mimics security without the actual structural protection of the Rules engine.

   Use Case Examples
   Relational Integrity (The "Escrow" Logic): A Purchase document must be created if and only if the Product status is simultaneously updated to sold in the same atomic transaction.

   External Validation (The "Verified Invite"): A server validates a one-time invite code against a 3rd-party API and "stamps" the request as valid. The Rules then check this stamp alongside request.auth to ensure the user isn't on a blacklist. The server validates the code; the Rules validate the user.

   State Synchronization (The "Booking Lock"): A user booking a hotel room must create a Booking doc and update the Room availability timestamp in one batch. Without is_transaction, rules cannot prevent "orphaned" bookings.

   Requested Features
   request.is_transaction: A boolean allowing rules to reject non-atomic "partial" updates to sensitive multi-document states.

   request.auth.token.server_assertions: A way for the Admin SDK to attach non-forgeable, temporary metadata to a user-authed request. This allows the server to act as a co-validator without needing a full administrative bypass.

   Appendix: Proposed Rule Syntax Examples
   A. Multi-Document Invariants

   JavaScript
   // Ensure a product status isn't flipped without a corresponding purchase record
   match /products/{productId} {
   allow update: if request.resource.data.status == 'sold'
   && request.istransaction == true
   && existsAfter(/databases/$(database)/documents/purchases/$(request.auth.uid)$(productId));
   }
   B. Co-Validation (Failable Requests)

   JavaScript
   // Server verifies the invite, Rules verify the user identity and blacklist status
   match /workspaces/{workspaceId}/members/{memberId} {
   allow create: if request.auth.uid == memberId
   && request.auth.token.serverassertions.inviteverified == true
   && !get(/databases/$(database)/documents/blacklist/$(memberId)).exists();
   }
   Summary: Firestore needs a way to combine user auth with trusted server assertions and transaction visibility. Without these, secure patterns are significantly harder to implement than unsafe ones.

   Firestore Security Rules currently lack two capabilities that force developers to choose between security, performance, and maintainability.

   1. Lack of Transaction/Batch Awareness Rules cannot verify if a write is part of an atomic batch or transaction. This makes it impossible to enforce multi-document integrity constraints natively.

   The Fallout: Developers must either trust the client to perform all parts of an operation (unsafe) or move logic to Cloud Functions. This introduces latency and cold-starts, but more importantly, it fragments security logic. Concise, native rules bolster security because they are easier to audit and are implemented correctly more often than fragmented, multi-layered workarounds.

   1. … more
   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Firestore  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. Allow users to easily leave or disconnect from Firebase projects they no longer belong to

   When developers change companies or stop collaborating on a project, they often remain listed as members of Firebase projects that they no longer use or have access to.

   Currently, the only way to be removed from a project is for a project owner or administrator to manually remove the user from the project permissions. This becomes problematic when:

   The developer no longer has contact with the project owner

   The company forgets to remove former collaborators

   The user wants to clean up their Firebase project list

   I suggest adding a “Leave Project” or “Disconnect from Project” option directly in the Firebase console for members.

   This feature could:

   Allow users to remove themselves from projects they no longer work on

   Improve security by reducing unnecessary access to company resources

   Help developers keep their Firebase console organized

   Reduce administrative overhead for project owners

   For example, developers who change jobs often still see old company projects in their Firebase dashboard, even though they no longer use them.

   A simple self-removal option would solve this problem in a secure and user-friendly way.

   When developers change companies or stop collaborating on a project, they often remain listed as members of Firebase projects that they no longer use or have access to.

   Currently, the only way to be removed from a project is for a project owner or administrator to manually remove the user from the project permissions. This becomes problematic when:

   The developer no longer has contact with the project owner

   The company forgets to remove former collaborators

   The user wants to clean up their Firebase project list

   I suggest adding a “Leave Project” or “Disconnect from Project” option directly in the Firebase… more

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Other  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. preview env links support

   currently its needed to deploy the app to firebase hosting AND firebase app hosting to get preview links working, thats making things more complex than needed...

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  App Hosting  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. I want to able to set Cloud Run Execution Environment in Cloud Functions

   https://docs.cloud.google.com/run/docs/configuring/execution-environments

   Since Cloud Functions v2 run on Cloud Run and Cloud Run supports two different execution environment, I want to be able to set them, e.g.

   const { onRequest } = require("firebase-functions/v2/https");

   // Set it for a specific function
   exports.myFunction = onRequest({
   executionEnvironment: 'gen1', // This tells Cloud Run to use its Gen1 environment
   memory: '256MiB',
   }, (req, res) => {
   res.send("Running on Cloud Run Gen1 environment!");
   });

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Cloud Functions for Firebase  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. ระบบตรวจบัตร (Auth): สร้างหน้าจอ Login สี #1A7AE6 ที่มีความปลอดภัยสูงสุดสำหรับท่าน?
   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Test Lab  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. [HIGH] Add support for bitwise operators in security rules

   It would be nice if we have support for & | ^ bitwise operators in security rules for both firestore and cloud storage.
   This highly improves roles and access rights check using only one integer instead of a Map of booleans.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Cloud Storage for Firebase  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. [HIGH] Add support for bitwise operators in security rules

   It would be nice if we have support for & | ^ bitwise operators in security rules for both firestore and cloud storage.
   This highly improves roles and access rights check using only one integer instead of a Map of booleans.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Firestore  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Online banking system bd

   Banking sescribstion

   0 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Agent Skills & MCP Server  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Support adding a note to each authorized domain in the auth settings

   We have a lot of authorized domains added by different team members. We'd like to remove unused ones, but we have no idea which ones are actually being used or why they were added. It'd be great if we could add a note to each item for future reference.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. gets even more faster and stronger at analysing and creating deep-driven ai agents and websites
    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Gemini in Firebase  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. Add a delete button to Cloud Functions...

    • There's literally no button to delete cloud functions anymore, i have no ability to delete them besides typing in 3 lines of code into the command line.
    • There's ellipsis buttons that do nothing when tapped.
    • There's a blue block at the bottom right of the view that does nothing and is a UI eye sore.
    • The webpage is in dark mode and hard to see ui elements despite my device not being in dark mode and other google services not in dark mode.
    • There's no support unless i pay.

    I must be in some unknown beta test because there's no way this trash can actually be in production.

    • There's literally no button to delete cloud functions anymore, i have no ability to delete them besides typing in 3 lines of code into the command line.
    • There's ellipsis buttons that do nothing when tapped.
    • There's a blue block at the bottom right of the view that does nothing and is a UI eye sore.
    • The webpage is in dark mode and hard to see ui elements despite my device not being in dark mode and other google services not in dark mode.
    • There's no support unless i pay.

    I must be in some unknown beta test because there's no… more

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Cloud Functions for Firebase  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. H

    firebase is not updating to blaze plan I already have a verified billing account you should have to give more information about how to set,

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Other  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Keep your stalker off of everything

    I'm so tired of my stalker taking over my phone. He's on everything!!

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Performance Monitoring  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Instead of firebase just being back en the server but if there’s another firebase part that acts as a the client-side

    That firebase lets you set up a frontend directly in firebase.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Other  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. Select More Than Current Billing Period for Metrics

    In the Authentication tab, we can see Daily Active Users and Monthly Active Users for the Current Billing Period. But We can't go back to see these statistics for previous months. Why?

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Analytics  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

16. to

    Rofikul22114

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Firestore  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

17. Firebase App Hosting: Full support for Next.js 16

    Next.js 16 introduced new APIs and major improvements around caching and rendering behavior. Next also open-sourced its adapter so third-party hosting providers can implement Next.js features more completely and stay aligned with upstream changes.

    It would be great if Firebase App Hosting fully supported Next.js 16 by integrating the open-source adapter and ensuring parity with Next.js’s caching and runtime behavior.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  App Hosting  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

18. সাইন-আপ

    সাইন-আপ

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Authentication  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

19. Nikhil petkar

    Any update online voting

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    3 comments  ·  Other  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

20. Make it easier to use Data Connect with Private IP Cloud SQL instance

    There is not documentation on how to connect Data Connect service to a Cloud SQL instance with Private IP. Deployment simply fails with timeout error.
    Had to open a support case to learn that I have to run the deployment command from within the same VPC. This should be at least documented. The deployment script could be improved, so that you don't have to run the deployment from a VM. The steps that are failing should be executed from the service directly, we'd just need to grant the required permissions to the SA.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  SQL Connect (Data Connect)  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating