Fix guides / Firestore: "Missing or insufficient permissions"

How to fix "FirebaseError: Missing or insufficient permissions"

Your app reads and writes Firestore fine, then one day every request fails with FirebaseError: Missing or insufficient permissions. Or it fails from the start for logged-in users. Firestore Security Rules are rejecting the request.

Why it suddenly broke after a month

When you create a Firestore database in test mode, Firebase writes rules that allow everything until a date about 30 days later:

allow read, write: if request.time < timestamp.date(2026, 11, 18);

When that date passes, every request is denied. Do not just push the date forward: until then, anyone with your project config (it is in your front-end code) could read and change all your data.

Write real rules

Firebase Console, Firestore Database, Rules. A common safe pattern for per-user data:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // each user can read and write only their own profile
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    // items owned by a user via an ownerId field
    match /items/{itemId} {
      allow read, update, delete: if request.auth != null && resource.data.ownerId == request.auth.uid;
      allow create: if request.auth != null && request.resource.data.ownerId == request.auth.uid;
    }
  }
}

Note the difference: resource.data is the document as stored; request.resource.data is the document being written. Create rules must check the new data.

Other causes

• The user is not signed in yet. The query runs before Firebase Auth finishes restoring the session, so request.auth is null. Wait for onAuthStateChanged to report a user before querying.
• Queries must match the rules. Rules are not filters. If a rule only allows documents where ownerId == request.auth.uid, the query itself must include where('ownerId', '==', user.uid), or Firestore rejects the whole query.
• Wrong collection name or path. A rule for /users/{id} does not cover a subcollection like /users/{id}/orders/{orderId}. Add a nested match for it.

Test before publishing

Use the Rules Playground in the Firebase Console to simulate a read or write as a specific signed-in user, then publish.

Last updated 2026-10-19.