How to access custom claims inside Cloud Firestore rules?

Question

I have an user which has the following custom user claims,

 customClaims: { role: 'admin' },

How can I access this role property (admin) inside the cloud firestore rules?

I'm using the code below, which doesn't work. What needs to be done in order to work?

match /companies/{document=**} {
  allow read: if request.auth != null;
  allow write: if request.auth != null && request.customClaims.role == "admin";
}

Tanjatanjore

Answer 1

Custom claims are in request.auth.token object as mentioned in the documentation:

match /companies/{document=**} {
  allow read: if request.auth != null;
  allow write: if request.auth != null && request.auth.token.role == "admin";
}

Wheelwork

I have added custom claims but can not access claims in security rules. Also the getIdTokenResult(true) provides my all claims but still can not able to access that claims in rules can anyone help me out – Reliquary

I had to use request.auth.token.customClaims.role – Lura

Answer 2

All claims (including custom ones) are available under the request.auth.token variable. Note that it may take up to an hour before the claims propagate to the security rules, as they are embedded in the user's ID token. If you want to speed this up, you can force reload the user profile, or sign them out and in again.

Also see:

• Firestore rules & custom claims

Hardwick

You can re-login into the app as well to test the new rules that uses the custom claims. I was struggling with it because the change to custom claim needs time to be reflected or you just have to sign out and sign back in. – Counterscarp

Answer 3

The custom claims exist in the request.auth.token object as fields , so all the custom claims can be accessed like this request.auth.token[your_custom_claim]

In your case you can access role like this request.auth.token.role

hope that helps :)

Oxendine