Effective Firestore Security

Cookpad Tech Kitchen #16 コメルコテックバナシ〜新規事業開発のリアル〜
https://cookpad.connpass.com/event/92325/
での登壇資料です。
---------------------------
Firestoreのrulesのサンプルコードは
https://github.com/sgr-ksmt/firebase-ec-demo
に公開しています

Transcript

1. Cookpad Inc. 2018.07.19(THU) Cookpad Tech Kitchen #16 &GGFDUJWF
   'JSFTUPSF
   4FDVSJUZ 4VHVSV
   ,JTIJNPUP
2. Cookpad Inc. All Rights Reserved. ͸ͬͽΐ͏͢Δͻͱ w,PNFSDPͰΤϯδχΞ͍ͯ͠·͢
   w։ൃॳظ͔Βݱࡏ΋
   wJ04ͱ'JSFCBTFͷೋ଍ͷΘΒ͡
   wΫοΫύουʹೖࣾͯ͠ϲ݄͘Β͍
   w4/4తͳ΋ͷ
   w5XJUUFS
   !THS@LTNU@EFW
   w(JU)VC
   THSLTNU
   w'JSFCBTFʹؔͯ͠هࣄॻ͍ͨΓϒϩάॻ͍ͨΓ
   w2JJUB
   IUUQTRJJUBDPNTHSLTNU
   w#MPH
   IUUQTUFDICMPHTHSLTNUPSH
3. Cookpad Inc. All Rights Reserved. ૣ଎Ͱ͕͢ɺɺɺ
4. Cookpad Inc. All Rights Reserved. $MPVE
   'JSFTUPSF
   ࢖ͬͯΔਓ
5. Cookpad Inc. All Rights Reserved. ηΩϡϦςΟϧʔϧ
   ͔ͬ͠ΓݻΊΒΕͯΔਓ
6. Cookpad Inc. All Rights Reserved. ηΩϡϦςΟϧʔϧ
   ೉͍͠ΑͶ
7. Cookpad Inc. All Rights Reserved. ͦ͏͍͑͹ɺগ͠લʹ
   ͜Μͳهࣄ͕࿩୊ʹ
8. Cookpad Inc. All Rights Reserved. ʮ߹ܭԯ݅Ҏ্ͷݸਓ৘ใ͕
   'JSFCBTFͷ੬ऑੑʹΑͬͯެ։ঢ়ଶʹʯ ग़య
   IUUQTHJHB[JOFOFUOFXTpSFCBTFWVMOFSBCJMJUZEBUBMPTT
   ݪจ
   IUUQTXXXBQQUIPSJUZDPNDPNQBOZQSFTTQSFTTSFMFBTFTPGFOUFSQSJTFTFYQPTFEUPTFOTJUJWFEBUBMPTTWJBpSFCBTFWVMOFSBCJMJUZ
9. Cookpad Inc. All Rights Reserved. ۩ମతʹ͸ wσʔλϕʔε΁ͷΞΫηεͷ੍ޚɺσʔλอޢ͕ద੾Ͱͳ͍ͱى ͜Γ͏Δ
   wΞϓϦέʔγϣϯͷίʔυͰ͸ͳ͘ɺόοΫΤϯυଆͰͷద੾ͳ ઃఆ͕͞Ε͍ͯͳ͍͜ͱ͕ݪҼͰ͋Δ
   wϢʔβʔ*%΍ύεϫʔυɺอޢ͞ΕΔ΂͖σʔλ͕ͷ΂ԯ݅Ҏ্ɺ ద੾ͳอޢ͕ͳ͞Εͣެ։ঢ়ଶʹͳ͍ͬͯΔ
10. Cookpad Inc. All Rights Reserved. ੬ऑੑʜ
11. Cookpad Inc. All Rights Reserved. ݸਓతͳݟղ
    ˚੬ऑੑ
    ̋։ൃऀଆɺηΩϡϦςΟରࡦͪΌΜͱ͍ͯ͜͠͏Ͷ
12. ։ൃ͢Δ্Ͱৗʹҙࣝ͢΂͖͜ͱ
13. Cookpad Inc. All Rights Reserved. ΞϓϦέʔγϣϯ͚ͩݟͯΔͱ
    ࡨ֮ͯ͠͠·͏͜ͱ
14. Cookpad Inc. All Rights Reserved.
15. Cookpad Inc. All Rights Reserved.
16. Cookpad Inc. All Rights Reserved. ΞϓϦέʔγϣϯҎ֎͔ΒͷΞΫηε͕
    ൃੜ͠͏Δ͜ͱΛҙࣝ͠ͳ͚Ε͹ͳΒͳ͍
17. Cookpad Inc. All Rights Reserved. ηΩϡϦςΟରࡦ͕؁͍ͱʜ
18. Cookpad Inc. All Rights Reserved. ى͜Γ͏Δࣄ wಡΈग़͠
    w೚ҙͷ%#ͷ৘ใΛಡΈऔΒΕͯ͠·͏
    wඇެ։ʹ͍ͯ͠Δ͸ͣͷσʔλΛऔಘ͞Εͯ͠·͏
 wॻ͖ࠐΈ
    wಛఆͷEBUB pFME͕ॻ͖׵͑ΒΕͯ͠·͏
    wαʔϏεͰҙਤ͠ͳ͍pFME͕ॻ͖ࠐ·Εͯ͠·͏
    wಛఆͷpMF͕ҙਤ͠ͳ͍pMFʹ্ॻ͖͞Εͯ͠·͏
19. Cookpad Inc. All Rights Reserved. ͜Ε͸·͍ͣ
20. Cookpad Inc. All Rights Reserved. 'JSFCBTFͷ"VUIͰೝূνΣοΫ͍ͯ͠ΔͳΒ
    େৎ෉͡Όͳ͍ͷʁ
21. Cookpad Inc. All Rights Reserved. େৎ෉͡Ό͋Γ·ͤΜ
22. Cookpad Inc. All Rights Reserved. ͳʹ͕·͍ͣͷ͔ w'JSFCBTFϓϩδΣΫτͷ8FC
    "1*
    LFZΛجʹ֤छػೳͷ3&45
    "1* ͕ୟ͚Δ
    w'JSFCBTFͷ"VUI͸3&45
    "1*ͰϢʔβʔ࡞੒ͨ͠Γ΋Ͱ͖Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTSFGFSFODFSFTUBVUITFDUJPOTJHOJO BOPOZNPVTMZ
    w$MPVE
    'JSFTUPSF͸3&45
    "1*Ͱୟ͚Δ
    w IUUQTpSFCBTFHPPHMFDPNEPDTpSFTUPSFVTFSFTUBQJ IMKB
23. Cookpad Inc. All Rights Reserved. ࣗ෼͕ͨͪ૝ఆ͍ͯ͠ΔϓϥοτϑΥʔϜҎ֎͔Β΋ɺ
    ಗ໊ೝূͨ͠ޙɺͦͷೝূ৘ใΛ༻͍ͯ
    ෆਖ਼ૢ࡞͞ΕΔڪΕ͕͋Δ
24. Cookpad Inc. All Rights Reserved. 'JSFTUPSF࢖͏ͳΒ͔ͬ͠ΓSVMFT͸ॻ͜͏ɻ
25. $MPVE
    'JSFTUPSFͷSVMFTΛ
    ॻ͘ʹ͋ͨͬͯେࣄͳ͜ͱ
26. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
27. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
28. Cookpad Inc. All Rights Reserved.
29. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
30. Cookpad Inc. All Rights Reserved.
31. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
32. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
33. Cookpad Inc. All Rights Reserved.
34. Cookpad Inc. All Rights Reserved.
35. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ wෆཁͳSVMFT͸ॻ͔ͳ͍
    wෆཁͳPQFSBUJPO͸མͱ͢
    wઃܭ͔࣌ΒಡΈॻ͖ͷݖݶΛҙࣝ͢Δ
    wൿಗ͠ͳ͍ͱ͍͚ͳ͍pFME͸ผϞσϧPSαϒίϨΫγϣϯΛݕ౼ ͢Δ
    wෳࡶ͗ͯ͢SVMFTΛॻ͚ͳ͍ͳΒ$MPVE'VODUJPOT౳Ͱಀ͕͢ͷ΋ख
36. Cookpad Inc. All Rights Reserved. େࣄͳ͜ͱ͸Θ͔͕ͬͨ
    Ͳ͏ॻ͍ͨΒྑ͍͔Θ͔ΒΜʜ
    αϯϓϧͱ͔ͳ͍ͷʁ
37. Cookpad Inc. All Rights Reserved. &$αʔϏεΛ୊ࡐͱͯ͠
    ؆୯ͳαϯϓϧΛެ։͠·ͨ͠ ˞؆୯ͳαϯϓϧͳͷͰ,PNFSDPͰͷߏ੒ͱ͸ҟͳΓ·͢ IUUQTHJUIVCDPNTHSLTNUpSFCBTFFDEFNP
38. Cookpad Inc. All Rights Reserved. ॻ͖ํʹ͍ͭͯͷ5JQT͸
    2JJUB΍#MPHʹ΋ॻ͍͍ͯΔͷͰͥͻ IUUQTRJJUBDPNTHSLTNU IUUQTUFDICMPHTHSLTNUPSH
39. ࠷ۙͷऔΓ૊Έ
40. Cookpad Inc. All Rights Reserved. 'JSFTUPSFͷSVMFT͕ਖ਼͘͠ಈ࡞͢Δ͔
    ςετΛॻ͍͍ͯΔ ࠷ۙͷऔΓ૊Έ
41. Cookpad Inc. All Rights Reserved. SVMFTͷγϛϡϨʔλ
    ͡ΌͩΊͳͷʁ
42. Cookpad Inc. All Rights Reserved. SVMFTͷγϛϡϨʔλ w1SPT
    wSVMFTͷEFQMPZલʹಈ࡞Λͬ͞ͱ֬ೝͰ͖Δ
    w%#ʹ͸࣮ࡍʹॻ͖ࠐ·Εͳ͍ͷͰԚછ͢Δ͜ͱ΋ͳ͍
    wطଘͷ%#ΛಡΈग़ͯ͠νΣοΫ͢Δ͜ͱ΋Մೳ
    w$POT
    wݱঢ়ɺਖ਼͘͠ಈ͔ͳ͍৚݅΋͋ΔͷͰɺશͯΛ໢ཏతʹγϛϡϨʔτ͔ͯ֬͠ ΊΔͷʹ͸ෆ޲͖
    wӨڹൣғͷ޿͍ॻ͖׵͑ͱ͔͢ΔͱγϛϡϨʔλʹͯ͠΋BQQͰ֬ೝʹͯ͠΋ ਓͷखͰ͔ͭͭ֬Ί͍ͯ͘ͷ͸ඇݱ࣮త
43. Cookpad Inc. All Rights Reserved. 'JSFTUPSF
    SVMFTͷςετ w'JSFCBTF1SPKFDUΛ෼͚Δ
    w,PNFSDPͰ͸ຊ൪؀ڥɺ։ൃ؀ڥͱ͸ผͰɺςετ༻ͷ
    
    
    
    
    
    'JSFCBTF
    1SPKFDUΛཱͯɺ$MPVE'VODUJPOTɺSVMFTͷςετΛ͍ͯ͠Δ
 wςετ༻ͷ؀ڥʹSVMFTΛEFQMPZͯ͠ɺΦϯϥΠϯςετΛ࣮ࢪ
    w࣮ࡍʹσʔλΛಡΈॻ͖ͯ͠ɺ`QFSNJTTJPOEFOJFE`͕ग़Δ͔Ͱͳ͍ ͔νΣοΫ͍ͯ͠Δ
    wςετΛॻ͘ͱ͖͸ϥΠϒϥϦͱͯ͠KFTU 5BSU 5PSUF Λ࢖༻
44. Cookpad Inc. All Rights Reserved. ߏ੒
45. Cookpad Inc. All Rights Reserved. %FWFMPQNFOU 5FTU $ yarn run firebase use test $ yarn run firebase deploy --only firestore:rules $ yarn run test 13 NBTUFSϒϥϯν΁ͷ
    Ϛʔδ࣌ʹςετΛ࣮ߦ $ yarn run firebase use development $ yarn run firebase deploy …
46. Cookpad Inc. All Rights Reserved. ςετίʔυ͸͜Μͳײ͡
47. Cookpad Inc. All Rights Reserved.
48. Cookpad Inc. All Rights Reserved. ςετ͕͋Δ͜ͱͰطଘͷSVMFTͷมߋ΋
    ͼ͘ͼ͘͠ͳͯ͘ࡁΉ
49. Cookpad Inc. All Rights Reserved. ৄ͘͠͸དྷ݄ͷฐٕࣾज़ϒϩάʹ
    ౤ߘ͠Α͏͔ͳͱ
50. Cookpad Inc. All Rights Reserved. ࠓҰ౓'JSFTUPSFͷSVMFTΛݟ௚ͯ͠
    ͬͯͳΒͳ͍Α͏ʹ͠Α͏
51. Cookpad Inc. All Rights Reserved. ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠