angular / angular/angularfire

Firebase storage 403 on delete

未關閉
#3,279 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
TypeScript
星號
7.8k
分支
2.2k
平均合併
22 小時 28 分鐘
30 天內合併 PR
6

描述

### Version info

**Angular:** 14.1.0

**Firebase:** 9.6.10

**AngularFire:** 7.4.0

**Other (e.g. Ionic/Cordova, Node, browser, operating system):**
Mac
node 16.16.0
Chrome latest

### How to reproduce these conditions

**Failing test unit, Stackblitz demonstrating the problem**

**Steps to set up and reproduce**

**Sample data and security rules**

private _getImagePath(): Observable {
return of('debug/users/%USERID%/images/exportimage'); //For demo purpose
}

// Succeeds
setImage(data: Blob): Observable {
return this._getImagePath().pipe(
switchMap(path => new Observable(obs => {
this.storage.ref(path).put(data).then(x => {
obs.next(x);
obs.complete();
});
}))
);
}

// Succeeds
getMetadata(): Observable{
return this._getImagePath().pipe(
switchMap(path => this.storage.ref(path).getMetadata())
);
}

// Succeeds
getUrl(): Observable{
return this._getImagePath().pipe(
switchMap(path => this.storage.ref(path).getDownloadURL())
);
}

// fails
deleteImage(){
return this._getImagePath().pipe(
switchMap(path => this.storage.ref(path).delete())
);
}

I get the same result from `this._storage.storage.refFromURL(url).delete()`

rules:

service firebase.storage {
match /b/admob-app-id-5092275243.appspot.com/o {
match /debug/users/{userId}/images/exportimage {
allow read: if request.auth.uid == userId;
allow write: if request.auth.uid == userId &&
request.resource.size < 1 * 1024 * 1024 &&
request.resource.contentType.matches('image/.*');
}

match /release/users/{userId}/images/exportimage {
allow read: if request.auth.uid == userId;
allow write: if request.auth.uid == userId &&
request.resource.size < 1 * 1024 * 1024 &&
request.resource.contentType.matches('image/.*');
}
}
}

### Debug output

** Errors in the JavaScript console **
FirebaseError: Firebase Storage: User does not have permission to access 'debug/users/L7vT58BkdXQTHa6nF3hNgHVeHcq1/images/exportimage'. (storage/unauthorized)

** Output from `firebase.database().enableLogging(true);` **

** Screenshots **

### Expected behavior

The image should be deleted

### Actual behavior

403 unauthorised

貢獻指南

開啟貢獻指南

研究方向

先從 deleteImage() 和 refFromURL(url).delete() 範例開始,然後檢查報告中顯示的 Firebase Storage 安全規則。使用列出的 Angular、Firebase 和 AngularFire 版本重現 403,並確定什麼行為應該允許刪除;當在文件所述規則下刪除成功,或證明該問題是設定問題時,即視為完成。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
firebase, typescript
領域
cloud
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
需要釐清
新手友好度
30/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。