#firestore-security-rules

Firestore Security Rules: Enforcing a Revocation Boundary for Revoked Sessions

Goal Enforce least-privilege in Firestore Security Rules so a revoked session — say, after a password reset handled with the Admin SDK's refresh-token revocation — stops authorizing reads and writes immediately instead of up to an hour later. Constraints ID tokens are short-lived JWTs that the client SDKs refresh automatically; a token generally stays valid

Community & Careers · Editorial question

custom-claimsfirestore-security-rulesfirebase