Effective Firestore Security

Cookpad Tech Kitchen #16 コメルコテックバナシ〜新規事業開発のリアル〜
https://cookpad.connpass.com/event/92325/
での登壇資料です。
---------------------------
Firestoreのrulesのサンプルコードは
https://github.com/sgr-ksmt/firebase-ec-demo
に公開しています

Transcript

1. Cookpad Inc.
   2018.07.19(THU)
   Cookpad Tech Kitchen #16
   &GGFDUJWF'JSFTUPSF4FDVSJUZ
   4VHVSV,JTIJNPUP
   

   View Slide

2. Cookpad Inc. All Rights Reserved.
   ͸ͬͽΐ͏͢Δͻͱ
   w,PNFSDPͰΤϯδχΞ͍ͯ͠·͢
   w։ൃॳظ͔Βݱࡏ΋
   wJ04ͱ'JSFCBTFͷೋ଍ͷΘΒ͡
   wΫοΫύουʹೖࣾͯ͠ϲ݄͘Β͍
   w4/4తͳ΋ͷ
   w5XJUUFS!THS@LTNU@EFW
   w(JU)VCTHSLTNU
   w'JSFCBTFʹؔͯ͠هࣄॻ͍ͨΓϒϩάॻ͍ͨΓ
   w2JJUBIUUQTRJJUBDPNTHSLTNU
   w#MPHIUUQTUFDICMPHTHSLTNUPSH
   

   View Slide

3. Cookpad Inc. All Rights Reserved.
   ૣ଎Ͱ͕͢ɺɺɺ
   

   View Slide

4. Cookpad Inc. All Rights Reserved.
   $MPVE'JSFTUPSF
   ࢖ͬͯΔਓ
   

   View Slide

5. Cookpad Inc. All Rights Reserved.
   ηΩϡϦςΟϧʔϧ
   ͔ͬ͠ΓݻΊΒΕͯΔਓ
   

   View Slide

6. Cookpad Inc. All Rights Reserved.
   ηΩϡϦςΟϧʔϧ
   ೉͍͠ΑͶ
   

   View Slide

7. Cookpad Inc. All Rights Reserved.
   ͦ͏͍͑͹ɺগ͠લʹ
   ͜Μͳهࣄ͕࿩୊ʹ
   

   View Slide

8. Cookpad Inc. All Rights Reserved.
   ʮ߹ܭԯ݅Ҏ্ͷݸਓ৘ใ͕
   'JSFCBTFͷ੬ऑੑʹΑͬͯެ։ঢ়ଶʹʯ
   ग़యIUUQTHJHB[JOFOFUOFXTpSFCBTFWVMOFSBCJMJUZEBUBMPTT
   ݪจIUUQTXXXBQQUIPSJUZDPNDPNQBOZQSFTTQSFTTSFMFBTFTPGFOUFSQSJTFTFYQPTFEUPTFOTJUJWFEBUBMPTTWJBpSFCBTFWVMOFSBCJMJUZ
   

   View Slide

9. Cookpad Inc. All Rights Reserved.
   ۩ମతʹ͸
   wσʔλϕʔε΁ͷΞΫηεͷ੍ޚɺσʔλอޢ͕ద੾Ͱͳ͍ͱى
   ͜Γ͏Δ
   wΞϓϦέʔγϣϯͷίʔυͰ͸ͳ͘ɺόοΫΤϯυଆͰͷద੾ͳ
   ઃఆ͕͞Ε͍ͯͳ͍͜ͱ͕ݪҼͰ͋Δ
   wϢʔβʔ*%΍ύεϫʔυɺอޢ͞ΕΔ΂͖σʔλ͕ͷ΂ԯ݅Ҏ্ɺ
   ద੾ͳอޢ͕ͳ͞Εͣެ։ঢ়ଶʹͳ͍ͬͯΔ
   

   View Slide

10. Cookpad Inc. All Rights Reserved.
    ੬ऑੑʜ
    

    View Slide

11. Cookpad Inc. All Rights Reserved.
    ݸਓతͳݟղ
    
    ˚੬ऑੑ
    ̋։ൃऀଆɺηΩϡϦςΟରࡦͪΌΜͱ͍ͯ͜͠͏Ͷ
    

    View Slide

12. ։ൃ͢Δ্Ͱৗʹҙࣝ͢΂͖͜ͱ
    

    View Slide

13. Cookpad Inc. All Rights Reserved.
    ΞϓϦέʔγϣϯ͚ͩݟͯΔͱ
    ࡨ֮ͯ͠͠·͏͜ͱ
    

    View Slide

14. Cookpad Inc. All Rights Reserved.
    

    View Slide

15. Cookpad Inc. All Rights Reserved.
    

    View Slide

16. Cookpad Inc. All Rights Reserved.
    ΞϓϦέʔγϣϯҎ֎͔ΒͷΞΫηε͕
    ൃੜ͠͏Δ͜ͱΛҙࣝ͠ͳ͚Ε͹ͳΒͳ͍
    

    View Slide

17. Cookpad Inc. All Rights Reserved.
    ηΩϡϦςΟରࡦ͕؁͍ͱʜ
    

    View Slide

18. Cookpad Inc. All Rights Reserved.
    ى͜Γ͏Δࣄ
    wಡΈग़͠
    w೚ҙͷ%#ͷ৘ใΛಡΈऔΒΕͯ͠·͏
    wඇެ։ʹ͍ͯ͠Δ͸ͣͷσʔλΛऔಘ͞Εͯ͠·͏

    wॻ͖ࠐΈ
    wಛఆͷEBUB pFME͕ॻ͖׵͑ΒΕͯ͠·͏
    wαʔϏεͰҙਤ͠ͳ͍pFME͕ॻ͖ࠐ·Εͯ͠·͏
    wಛఆͷpMF͕ҙਤ͠ͳ͍pMFʹ্ॻ͖͞Εͯ͠·͏
    

    View Slide

19. Cookpad Inc. All Rights Reserved.
    ͜Ε͸·͍ͣ
    

    View Slide

20. Cookpad Inc. All Rights Reserved.
    'JSFCBTFͷ"VUIͰೝূνΣοΫ͍ͯ͠ΔͳΒ
    େৎ෉͡Όͳ͍ͷʁ
    

    View Slide

21. Cookpad Inc. All Rights Reserved.
    େৎ෉͡Ό͋Γ·ͤΜ
    

    View Slide

22. Cookpad Inc. All Rights Reserved.
    ͳʹ͕·͍ͣͷ͔
    w'JSFCBTFϓϩδΣΫτͷ8FC"1*LFZΛجʹ֤छػೳͷ3&45"1*
    ͕ୟ͚Δ
    w'JSFCBTFͷ"VUI͸3&45"1*ͰϢʔβʔ࡞੒ͨ͠Γ΋Ͱ͖Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTSFGFSFODFSFTUBVUITFDUJPOTJHOJO
    BOPOZNPVTMZ
    w$MPVE'JSFTUPSF͸3&45"1*Ͱୟ͚Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTpSFTUPSFVTFSFTUBQJ IMKB
    

    View Slide

23. Cookpad Inc. All Rights Reserved.
    ࣗ෼͕ͨͪ૝ఆ͍ͯ͠ΔϓϥοτϑΥʔϜҎ֎͔Β΋ɺ
    ಗ໊ೝূͨ͠ޙɺͦͷೝূ৘ใΛ༻͍ͯ
    ෆਖ਼ૢ࡞͞ΕΔڪΕ͕͋Δ
    

    View Slide

24. Cookpad Inc. All Rights Reserved.
    'JSFTUPSF࢖͏ͳΒ͔ͬ͠ΓSVMFT͸ॻ͜͏ɻ
    

    View Slide

25. $MPVE'JSFTUPSFͷSVMFTΛ
    ॻ͘ʹ͋ͨͬͯେࣄͳ͜ͱ
    

    View Slide

26. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

27. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

28. Cookpad Inc. All Rights Reserved.
    

    View Slide

29. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

30. Cookpad Inc. All Rights Reserved.
    

    View Slide

31. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

32. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

33. Cookpad Inc. All Rights Reserved.
    

    View Slide

34. Cookpad Inc. All Rights Reserved.
    

    View Slide

35. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
    

    View Slide

36. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ͸Θ͔͕ͬͨ
    Ͳ͏ॻ͍ͨΒྑ͍͔Θ͔ΒΜʜ
    αϯϓϧͱ͔ͳ͍ͷʁ
    

    View Slide

37. Cookpad Inc. All Rights Reserved.
    &$αʔϏεΛ୊ࡐͱͯ͠
    ؆୯ͳαϯϓϧΛެ։͠·ͨ͠
    ˞؆୯ͳαϯϓϧͳͷͰ,PNFSDPͰͷߏ੒ͱ͸ҟͳΓ·͢
    IUUQTHJUIVCDPNTHSLTNUpSFCBTFFDEFNP
    

    View Slide

38. Cookpad Inc. All Rights Reserved.
    ॻ͖ํʹ͍ͭͯͷ5JQT͸
    2JJUB΍#MPHʹ΋ॻ͍͍ͯΔͷͰͥͻ
    IUUQTRJJUBDPNTHSLTNU
    IUUQTUFDICMPHTHSLTNUPSH
    

    View Slide

39. ࠷ۙͷऔΓ૊Έ
    

    View Slide

40. Cookpad Inc. All Rights Reserved.
    'JSFTUPSFͷSVMFT͕ਖ਼͘͠ಈ࡞͢Δ͔
    ςετΛॻ͍͍ͯΔ
    ࠷ۙͷऔΓ૊Έ
    

    View Slide

41. Cookpad Inc. All Rights Reserved.
    SVMFTͷγϛϡϨʔλ
    ͡ΌͩΊͳͷʁ
    

    View Slide

42. Cookpad Inc. All Rights Reserved.
    SVMFTͷγϛϡϨʔλ
    w1SPT
    wSVMFTͷEFQMPZલʹಈ࡞Λͬ͞ͱ֬ೝͰ͖Δ
    w%#ʹ͸࣮ࡍʹॻ͖ࠐ·Εͳ͍ͷͰԚછ͢Δ͜ͱ΋ͳ͍
    wطଘͷ%#ΛಡΈग़ͯ͠νΣοΫ͢Δ͜ͱ΋Մೳ
    w$POT
    wݱঢ়ɺਖ਼͘͠ಈ͔ͳ͍৚݅΋͋ΔͷͰɺશͯΛ໢ཏతʹγϛϡϨʔτ͔ͯ֬͠
    ΊΔͷʹ͸ෆ޲͖
    wӨڹൣғͷ޿͍ॻ͖׵͑ͱ͔͢ΔͱγϛϡϨʔλʹͯ͠΋BQQͰ֬ೝʹͯ͠΋
    ਓͷखͰ͔ͭͭ֬Ί͍ͯ͘ͷ͸ඇݱ࣮త
    

    View Slide

43. Cookpad Inc. All Rights Reserved.
    'JSFTUPSFSVMFTͷςετ
    w'JSFCBTF1SPKFDUΛ෼͚Δ
    w,PNFSDPͰ͸ຊ൪؀ڥɺ։ൃ؀ڥͱ͸ผͰɺςετ༻ͷ
    'JSFCBTF1SPKFDUΛཱͯɺ$MPVE'VODUJPOTɺSVMFTͷςετΛ͍ͯ͠Δ

    wςετ༻ͷ؀ڥʹSVMFTΛEFQMPZͯ͠ɺΦϯϥΠϯςετΛ࣮ࢪ
    w࣮ࡍʹσʔλΛಡΈॻ͖ͯ͠ɺ`QFSNJTTJPOEFOJFE`͕ग़Δ͔Ͱͳ͍
    ͔νΣοΫ͍ͯ͠Δ
    wςετΛॻ͘ͱ͖͸ϥΠϒϥϦͱͯ͠KFTU5BSU 5PSUF
    Λ࢖༻
    

    View Slide

44. Cookpad Inc. All Rights Reserved.
    ߏ੒
    

    View Slide

45. Cookpad Inc. All Rights Reserved.
    %FWFMPQNFOU
    5FTU
    $ yarn run firebase use test
    $ yarn run firebase deploy --only firestore:rules
    $ yarn run test
    13 NBTUFSϒϥϯν΁ͷ
    Ϛʔδ࣌ʹςετΛ࣮ߦ
    $ yarn run firebase use development
    $ yarn run firebase deploy …
    

    View Slide

46. Cookpad Inc. All Rights Reserved.
    ςετίʔυ͸͜Μͳײ͡
    

    View Slide

47. Cookpad Inc. All Rights Reserved.
    

    View Slide

48. Cookpad Inc. All Rights Reserved.
    ςετ͕͋Δ͜ͱͰطଘͷSVMFTͷมߋ΋
    ͼ͘ͼ͘͠ͳͯ͘ࡁΉ
    

    View Slide

49. Cookpad Inc. All Rights Reserved.
    ৄ͘͠͸དྷ݄ͷฐٕࣾज़ϒϩάʹ
    ౤ߘ͠Α͏͔ͳͱ
    

    View Slide

50. Cookpad Inc. All Rights Reserved.
    ࠓҰ౓'JSFTUPSFͷSVMFTΛݟ௚ͯ͠
    ͬͯͳΒͳ͍Α͏ʹ͠Α͏
    

    View Slide

51. Cookpad Inc. All Rights Reserved.
    ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠
    

    View Slide