Security Rules on Firebase

In order to run fast operations on Bubble's front-end and also allow for no-code configuration, when you specify the Firebase account configuration of the site, this data might be exposed on the page HTML content.

Because of that we strongly recommend every developer to properly configure Security Rules for Firestore and Firebase Storage.

To do so, you must go to your projects console, on the Firestore or Storage pages, and click on the "Rules" tab.

You must always configure your Security Rules for Firestore and Firebase Storage properly, to avoid unwanted uses of you Firebase connection.

Using backend workflows for better security

When you use backend actions from the plugin, as they run server-side code, they can bypass security rules, but there is a caveat: Bubble's backend actions for plugins are always slow to start! They take up to 30 seconds to execute, no matter how simple their login is.

That's because they kind of need time on first run to "load themselves into Bubble's server memory" (that not an official statement from Bubble, but rather how we rationalize it). After this first execution, they tent to run faster for a couple of minutes.

So, you can use them when you need a more secure way to deal with data on Firebase, but you'll have to work around the long execution times limitation and deal with a greater Workload Consumption because of that.

Tip: You can run backend operations on a Scheduled Backend Workflow, in order to free your users from the "burden" of having to wait the server-site action warm up time.

Bubble's Privacy Rules x Firebase Security Rules

Firebase security rules work differently from Bubble's privacy rules. While on Bubble they work as a kind of "filter" for data, on Firebase they work as "blockers".

So, if you define the rule on Bubble that User's can only see their own data, if you try to fetch more user's in a list or a Repeating Group, for instance, no matter how you set the search, Bubble will only give the user's available data. It will simply not fetch the other user's.

In Firebase, on the other hand, if you set the same rule, the entire query will fail and you won't receive any data, only an error message on your browser's Console: "Firestore Data Plugin Error: Missing or insufficient permissions."

Firestore Data Plugin Error: Missing or insufficient permissions.

Tip: You can open your browser's dev tools (press "F12") to read any errors or warning messages given by our plugin.