How can I restrict Firebase Firestore access to requests from a specific website?

Firebase Firestore security rules don't offer a way to restrict access based on the originating web domain. The rules evaluate properties of the request such as authentication status, user UID, and data in the request, but they do not include HTTP headers (like the Origin or Referer) that indicate the request's source.

This means that even if your website is hosted on a particular domain, someone can mimic the requests (e.g., via curl or a custom client) to bypass a domain-based check—if you based your security solely on the assumption that requests come from your domain.

Recommended Approaches

• Use Firebase Authentication:
  Secure your Firestore data by authenticating users. Once users are authenticated (through Firebase Auth), you can enforce rules that only allow access to their own data. For instance:

  JSCopied
  service cloud.firestore {
    match /databases/{database}/documents {
      match /userData/{userId} {
        allow read, write: if request.auth != null &&
                           request.auth.uid == userId;
      }
    }
  }

• API Key Restrictions for Other Firebase Services:
  While Firestore security rules cannot check the web domain, you can secure the associated API key by restricting its usage to your website in the Google Cloud Console. Note that these restrictions help prevent unauthorized use of your API key, but they do not serve as a standalone security mechanism for Firestore queries.

• Backend Proxy:
  Another approach is to use your own backend server that validates requests (checking the domain, session, or other criteria) and then communicates with Firestore. This isolates Firestore access from direct client requests but adds additional complexity.

Summary

Directly enforcing domain-based access in Firestore security rules isn’t possible. It’s best to rely on user authentication and proper rule design to secure your data, and if needed, use additional measures such as API key restrictions or a backend proxy to enhance overall security.