gistfile1.txt

... this curl should not work.

curl 'https://firebasestorage.googleapis.com/v0/b/polar-32b0f.appspot.com/o/stash%2F12RMNjmX1PLwqN5fRXzh89Yi7tbL24e5VfCNs4Nq.pdf?alt=media&token=0a2708be-ef63-4791-a338-a3c887b73b19' -H 'Referer: https://localapp.getpolarized.io/pdfviewer/web/index.html?file=https%3A%2F%2Ffirebasestorage.googleapis.com%2Fv0%2Fb%2Fpolar-32b0f.appspot.com%2Fo%2Fstash%252F12RMNjmX1PLwqN5fRXzh89Yi7tbL24e5VfCNs4Nq.pdf%3Falt%3Dmedia%26token%3D0a2708be-ef63-4791-a338-a3c887b73b19&filename=12LbgQGLbr-The+Complete+Guide+To+Statistics+For+The+SaaS+Executive.pdf&zoom=page-width&shared=true&doc=12oorv23zKSXGuy4veGpChyVHcP39Xnt' -H 'Origin: https://localapp.getpolarized.io' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36' -H 'DNT: 1' --compressed



service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {

      // Allow read and write when the resource is missing OR the user is the 
      // owner of the resource. Note that it's important to allow both reads
      // and writes if the document is missing. If it's missing then want the 
      // user to create it and then own it.  If it is present then we want 
      // validate against the existing uid.  
      
      allow read: if request.auth != null && (resource == null || request.auth.uid == resource.metadata.uid || resource.metadata.visibility == 'public');
      allow write: if request.auth != null && (resource == null || request.auth.uid == resource.metadata.uid);
      
    }
  }
}