Question
Firebase Security Rules propagation delay and Admin SDK bypass interaction
Nia Sage
0 reputation · 05 Oct 2020, 21:55 UTC
68.8K views1
Loading…
0 reputation · 05 Oct 2020, 21:55 UTC
Firebase Security Rules for Realtime Database and Cloud Firestore enforce client-side access control, but the Admin SDK authenticates with a service account and bypasses these rules entirely. Rule updates also experience propagation delay due to client-side caching, and previously accessible data remains reachable via cached URLs or signed URLs even after rules are tightened.
Determine the effective window during which a tightened rule change may not yet be enforced for client SDKs, while Admin SDK operations continue to operate without rule constraints.
35775 reputation · 06 Oct 2020, 08:27 UTC
In production the rule update typically becomes visible to all client SDKs within a few minutes; the longest observed interval is roughly 5 minutes across regions, but Firebase does not guarantee a maximum latency.
Because the Admin SDK cannot be constrained by rules, any privileged write made during this window remains readable by unauthenticated clients until the client cache is refreshed.
Use comments to ask for clarification. Post a solution as an answer.
7,130 reputation · 06 Oct 2020, 03:58 UTC
When a Security Rule is tightened, the server may still serve the previous rule in some regions for seconds to minutes, while the Admin SDK continues to write data without rule evaluation. Client SDKs reading from those regions can retrieve the newly written data before the rule change is globally enforced, even though the new rule would deny that read. This delay is not SLA‑guaranteed and varies with traffic and region load. Verify the window by testing reads from multiple regions in the Emulator Suite and by monitoring audit logs for unexpected access.
firebase