匿名身份验证够吗？

通常没有

仅使用匿名身份验证会增加访问数据库的障碍，并且可以像进行数据库完全打开一样保护它免受简单的读取查询，但是您应该将其与限制可以执行的查询的安全规则结合使用。

假设我们从以下准系统规则开始：

// Allow read access on all documents to any user signed in to the application,
// and write access to only administrators
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if request.auth.uid != null;
      allow write: if request.auth.token.isAdmin === true;
    }
  }
}

要收紧规则，您应该首先删除通配符条目，然后将其替换为固定的文档路径。

// Allow read access on all documents at /posts/{postId} to any user signed in to the application,
// and write access to only administrators
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow read: if request.auth.uid != null;
      allow write: if request.auth.token.isAdmin === true;
    }
  }
}

甚至

// Allow read access on all documents at /posts/{postId} to any user signed in to the application,
// and write access to only administrators
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow read: if request.auth.uid != null;
      allow write: if request.auth.token.isAdmin === true;

      // allow same permissions on subcollections of /posts/{postId}
      match /{document=**} {
        allow read: if request.auth.uid != null;
        allow write: if request.auth.token.isAdmin === true;
      }
    }
  }
}

接下来，您应该考虑添加规则，以使用Firebase文档中所述的粒度安全list规则来限制针对数据库执行的查询的大小Securely query data。

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postid} {

      // Deny any query not limited to 10 or fewer documents
      allow list: if request.auth != null
                  && request.query.limit <= 10;

      // Anyone can retrieve an individual post
      allow get: if request.auth != null;

      // Only an admin can write to posts
      allow write: if request.auth.token.isAdmin === true;
    }
  }
}

根据数据更新的频率，您还可以考虑将数据束存储在Firebase Storage上，或者甚至可以从Firebase Hosting提供数据，在CDN而不是您的应用程序可以提供这些数据束。