Firebase Cloud Storage
Firebase Cloud Storage shares a security-rules model with the Realtime Database but stores object blobs on top of GCS. The same `allow read: if true;` tutorial pattern unlocks the whole bucket to unauthenticated callers.
Firebase Cloud Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
The rule `allow read, write: if request.auth != null;` (the Firebase wizard's default) sounds restrictive but actually grants any signed-in user (including anonymous-auth sessions) access to the entire bucket cross-tenant.
Real-world impact
Anonymous-auth-eligible buckets can be enumerated by listing tokens cheaply. Profile photos, file uploads, and user-generated content all leak.
Remediation
- Scope rules per-user: `allow read, write: if request.auth != null && request.auth.uid == userId;`
- Disable Anonymous Authentication in the Firebase Auth providers list if you're not using it.
URL patterns
Firebase Cloud Storage buckets typically resolve under hostnames like:
firebasestorage.googleapis.com/v0/b/example.appspot.com/o
Check a specific Firebase Cloud Storage URL
Paste any Firebase Cloud Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Firebase Cloud Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request