Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Effective Firestore Security

Effective Firestore Security

Cookpad Tech Kitchen #16 コメルコテックバナシ〜新規事業開発のリアル〜
https://cookpad.connpass.com/event/92325/
での登壇資料です。
---------------------------
Firestoreのrulesのサンプルコードは
https://github.com/sgr-ksmt/firebase-ec-demo
に公開しています

Suguru Kishimoto

July 19, 2018
Tweet

More Decks by Suguru Kishimoto

Other Decks in Technology

Transcript

  1. Cookpad Inc.
    2018.07.19(THU)
    Cookpad Tech Kitchen #16
    &GGFDUJWF'JSFTUPSF4FDVSJUZ
    4VHVSV,JTIJNPUP

    View Slide

  2. Cookpad Inc. All Rights Reserved.
    ͸ͬͽΐ͏͢Δͻͱ
    w,PNFSDPͰΤϯδχΞ͍ͯ͠·͢
    w։ൃॳظ͔Βݱࡏ΋
    wJ04ͱ'JSFCBTFͷೋ଍ͷΘΒ͡
    wΫοΫύουʹೖࣾͯ͠ϲ݄͘Β͍
    w4/4తͳ΋ͷ
    w5XJUUFS!THS@LTNU@EFW
    w(JU)VCTHSLTNU
    w'JSFCBTFʹؔͯ͠هࣄॻ͍ͨΓϒϩάॻ͍ͨΓ
    w2JJUBIUUQTRJJUBDPNTHSLTNU
    w#MPHIUUQTUFDICMPHTHSLTNUPSH

    View Slide

  3. Cookpad Inc. All Rights Reserved.
    ૣ଎Ͱ͕͢ɺɺɺ

    View Slide

  4. Cookpad Inc. All Rights Reserved.
    $MPVE'JSFTUPSF
    ࢖ͬͯΔਓ

    View Slide

  5. Cookpad Inc. All Rights Reserved.
    ηΩϡϦςΟϧʔϧ
    ͔ͬ͠ΓݻΊΒΕͯΔਓ

    View Slide

  6. Cookpad Inc. All Rights Reserved.
    ηΩϡϦςΟϧʔϧ
    ೉͍͠ΑͶ

    View Slide

  7. Cookpad Inc. All Rights Reserved.
    ͦ͏͍͑͹ɺগ͠લʹ
    ͜Μͳهࣄ͕࿩୊ʹ

    View Slide

  8. Cookpad Inc. All Rights Reserved.
    ʮ߹ܭԯ݅Ҏ্ͷݸਓ৘ใ͕
    'JSFCBTFͷ੬ऑੑʹΑͬͯެ։ঢ়ଶʹʯ
    ग़యIUUQTHJHB[JOFOFUOFXTpSFCBTFWVMOFSBCJMJUZEBUBMPTT
    ݪจIUUQTXXXBQQUIPSJUZDPNDPNQBOZQSFTTQSFTTSFMFBTFTPGFOUFSQSJTFTFYQPTFEUPTFOTJUJWFEBUBMPTTWJBpSFCBTFWVMOFSBCJMJUZ

    View Slide

  9. Cookpad Inc. All Rights Reserved.
    ۩ମతʹ͸
    wσʔλϕʔε΁ͷΞΫηεͷ੍ޚɺσʔλอޢ͕ద੾Ͱͳ͍ͱى
    ͜Γ͏Δ
    wΞϓϦέʔγϣϯͷίʔυͰ͸ͳ͘ɺόοΫΤϯυଆͰͷద੾ͳ
    ઃఆ͕͞Ε͍ͯͳ͍͜ͱ͕ݪҼͰ͋Δ
    wϢʔβʔ*%΍ύεϫʔυɺอޢ͞ΕΔ΂͖σʔλ͕ͷ΂ԯ݅Ҏ্ɺ
    ద੾ͳอޢ͕ͳ͞Εͣެ։ঢ়ଶʹͳ͍ͬͯΔ

    View Slide

  10. Cookpad Inc. All Rights Reserved.
    ੬ऑੑʜ

    View Slide

  11. Cookpad Inc. All Rights Reserved.
    ݸਓతͳݟղ

    ˚੬ऑੑ
    ̋։ൃऀଆɺηΩϡϦςΟରࡦͪΌΜͱ͍ͯ͜͠͏Ͷ

    View Slide

  12. ։ൃ͢Δ্Ͱৗʹҙࣝ͢΂͖͜ͱ

    View Slide

  13. Cookpad Inc. All Rights Reserved.
    ΞϓϦέʔγϣϯ͚ͩݟͯΔͱ
    ࡨ֮ͯ͠͠·͏͜ͱ

    View Slide

  14. Cookpad Inc. All Rights Reserved.

    View Slide

  15. Cookpad Inc. All Rights Reserved.

    View Slide

  16. Cookpad Inc. All Rights Reserved.
    ΞϓϦέʔγϣϯҎ֎͔ΒͷΞΫηε͕
    ൃੜ͠͏Δ͜ͱΛҙࣝ͠ͳ͚Ε͹ͳΒͳ͍

    View Slide

  17. Cookpad Inc. All Rights Reserved.
    ηΩϡϦςΟରࡦ͕؁͍ͱʜ

    View Slide

  18. Cookpad Inc. All Rights Reserved.
    ى͜Γ͏Δࣄ
    wಡΈग़͠
    w೚ҙͷ%#ͷ৘ใΛಡΈऔΒΕͯ͠·͏
    wඇެ։ʹ͍ͯ͠Δ͸ͣͷσʔλΛऔಘ͞Εͯ͠·͏

    wॻ͖ࠐΈ
    wಛఆͷEBUB pFME͕ॻ͖׵͑ΒΕͯ͠·͏
    wαʔϏεͰҙਤ͠ͳ͍pFME͕ॻ͖ࠐ·Εͯ͠·͏
    wಛఆͷpMF͕ҙਤ͠ͳ͍pMFʹ্ॻ͖͞Εͯ͠·͏

    View Slide

  19. Cookpad Inc. All Rights Reserved.
    ͜Ε͸·͍ͣ

    View Slide

  20. Cookpad Inc. All Rights Reserved.
    'JSFCBTFͷ"VUIͰೝূνΣοΫ͍ͯ͠ΔͳΒ
    େৎ෉͡Όͳ͍ͷʁ

    View Slide

  21. Cookpad Inc. All Rights Reserved.
    େৎ෉͡Ό͋Γ·ͤΜ

    View Slide

  22. Cookpad Inc. All Rights Reserved.
    ͳʹ͕·͍ͣͷ͔
    w'JSFCBTFϓϩδΣΫτͷ8FC"1*LFZΛجʹ֤छػೳͷ3&45"1*
    ͕ୟ͚Δ
    w'JSFCBTFͷ"VUI͸3&45"1*ͰϢʔβʔ࡞੒ͨ͠Γ΋Ͱ͖Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTSFGFSFODFSFTUBVUITFDUJPOTJHOJO
    BOPOZNPVTMZ
    w$MPVE'JSFTUPSF͸3&45"1*Ͱୟ͚Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTpSFTUPSFVTFSFTUBQJ IMKB

    View Slide

  23. Cookpad Inc. All Rights Reserved.
    ࣗ෼͕ͨͪ૝ఆ͍ͯ͠ΔϓϥοτϑΥʔϜҎ֎͔Β΋ɺ
    ಗ໊ೝূͨ͠ޙɺͦͷೝূ৘ใΛ༻͍ͯ
    ෆਖ਼ૢ࡞͞ΕΔڪΕ͕͋Δ

    View Slide

  24. Cookpad Inc. All Rights Reserved.
    'JSFTUPSF࢖͏ͳΒ͔ͬ͠ΓSVMFT͸ॻ͜͏ɻ

    View Slide

  25. $MPVE'JSFTUPSFͷSVMFTΛ
    ॻ͘ʹ͋ͨͬͯେࣄͳ͜ͱ

    View Slide

  26. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  27. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  28. Cookpad Inc. All Rights Reserved.

    View Slide

  29. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  30. Cookpad Inc. All Rights Reserved.

    View Slide

  31. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  32. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  33. Cookpad Inc. All Rights Reserved.

    View Slide

  34. Cookpad Inc. All Rights Reserved.

    View Slide

  35. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ
    wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼
    ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख

    View Slide

  36. Cookpad Inc. All Rights Reserved.
    େࣄͳ͜ͱ͸Θ͔͕ͬͨ
    Ͳ͏ॻ͍ͨΒྑ͍͔Θ͔ΒΜʜ
    αϯϓϧͱ͔ͳ͍ͷʁ

    View Slide

  37. Cookpad Inc. All Rights Reserved.
    &$αʔϏεΛ୊ࡐͱͯ͠
    ؆୯ͳαϯϓϧΛެ։͠·ͨ͠
    ˞؆୯ͳαϯϓϧͳͷͰ,PNFSDPͰͷߏ੒ͱ͸ҟͳΓ·͢
    IUUQTHJUIVCDPNTHSLTNUpSFCBTFFDEFNP

    View Slide

  38. Cookpad Inc. All Rights Reserved.
    ॻ͖ํʹ͍ͭͯͷ5JQT͸
    2JJUB΍#MPHʹ΋ॻ͍͍ͯΔͷͰͥͻ
    IUUQTRJJUBDPNTHSLTNU
    IUUQTUFDICMPHTHSLTNUPSH

    View Slide

  39. ࠷ۙͷऔΓ૊Έ

    View Slide

  40. Cookpad Inc. All Rights Reserved.
    'JSFTUPSFͷSVMFT͕ਖ਼͘͠ಈ࡞͢Δ͔
    ςετΛॻ͍͍ͯΔ
    ࠷ۙͷऔΓ૊Έ

    View Slide

  41. Cookpad Inc. All Rights Reserved.
    SVMFTͷγϛϡϨʔλ
    ͡ΌͩΊͳͷʁ

    View Slide

  42. Cookpad Inc. All Rights Reserved.
    SVMFTͷγϛϡϨʔλ
    w1SPT
    wSVMFTͷEFQMPZલʹಈ࡞Λͬ͞ͱ֬ೝͰ͖Δ
    w%#ʹ͸࣮ࡍʹॻ͖ࠐ·Εͳ͍ͷͰԚછ͢Δ͜ͱ΋ͳ͍
    wطଘͷ%#ΛಡΈग़ͯ͠νΣοΫ͢Δ͜ͱ΋Մೳ
    w$POT
    wݱঢ়ɺਖ਼͘͠ಈ͔ͳ͍৚݅΋͋ΔͷͰɺશͯΛ໢ཏతʹγϛϡϨʔτ͔ͯ֬͠
    ΊΔͷʹ͸ෆ޲͖
    wӨڹൣғͷ޿͍ॻ͖׵͑ͱ͔͢ΔͱγϛϡϨʔλʹͯ͠΋BQQͰ֬ೝʹͯ͠΋
    ਓͷखͰ͔ͭͭ֬Ί͍ͯ͘ͷ͸ඇݱ࣮త

    View Slide

  43. Cookpad Inc. All Rights Reserved.
    'JSFTUPSFSVMFTͷςετ
    w'JSFCBTF1SPKFDUΛ෼͚Δ
    w,PNFSDPͰ͸ຊ൪؀ڥɺ։ൃ؀ڥͱ͸ผͰɺςετ༻ͷ
    'JSFCBTF1SPKFDUΛཱͯɺ$MPVE'VODUJPOTɺSVMFTͷςετΛ͍ͯ͠Δ

    wςετ༻ͷ؀ڥʹSVMFTΛEFQMPZͯ͠ɺΦϯϥΠϯςετΛ࣮ࢪ
    w࣮ࡍʹσʔλΛಡΈॻ͖ͯ͠ɺ`QFSNJTTJPOEFOJFE`͕ग़Δ͔Ͱͳ͍
    ͔νΣοΫ͍ͯ͠Δ
    wςετΛॻ͘ͱ͖͸ϥΠϒϥϦͱͯ͠KFTU5BSU 5PSUF
    Λ࢖༻

    View Slide

  44. Cookpad Inc. All Rights Reserved.
    ߏ੒

    View Slide

  45. Cookpad Inc. All Rights Reserved.
    %FWFMPQNFOU
    5FTU
    $ yarn run firebase use test
    $ yarn run firebase deploy --only firestore:rules
    $ yarn run test
    13 NBTUFSϒϥϯν΁ͷ
    Ϛʔδ࣌ʹςετΛ࣮ߦ
    $ yarn run firebase use development
    $ yarn run firebase deploy …

    View Slide

  46. Cookpad Inc. All Rights Reserved.
    ςετίʔυ͸͜Μͳײ͡

    View Slide

  47. Cookpad Inc. All Rights Reserved.

    View Slide

  48. Cookpad Inc. All Rights Reserved.
    ςετ͕͋Δ͜ͱͰطଘͷSVMFTͷมߋ΋
    ͼ͘ͼ͘͠ͳͯ͘ࡁΉ

    View Slide

  49. Cookpad Inc. All Rights Reserved.
    ৄ͘͠͸དྷ݄ͷฐٕࣾज़ϒϩάʹ
    ౤ߘ͠Α͏͔ͳͱ

    View Slide

  50. Cookpad Inc. All Rights Reserved.
    ࠓҰ౓'JSFTUPSFͷSVMFTΛݟ௚ͯ͠
    ͬͯͳΒͳ͍Α͏ʹ͠Α͏

    View Slide

  51. Cookpad Inc. All Rights Reserved.
    ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠

    View Slide