151
MCQmedium
A company's Firestore security rules are too permissive, allowing all users to read and write any document. They need to restrict access so that only authenticated users can read and write their own data. Which rule structure should they use?
A.Allow read/write if request.auth.uid == resource.data.user_id;
B.Allow read/write if request.auth != null;
C.Allow read/write if request.auth != null && request.auth.uid == resource.id;
D.Allow read/write if request.auth.token.email == resource.data.email;
AnswerA
This restricts access to documents where the user ID field matches the authenticated user.
Why this answer
Firestore security rules can use `request.auth.uid` to verify the authenticated user's identity and `resource.data.user_id` to check ownership. The correct rule ensures that the authenticated user's UID matches the `user_id` field in the document.