Firebase Firestore — permission-denied on document access

Firestore returns permission-denied because the security rules do not allow the authenticated user to read or write the requested document or collection.

beginnerdebuggingfirebasefirestore

Symptoms

FirebaseError: Missing or insufficient permissions
Document read works in simulator but not from the client
Write fails only for certain document paths

Possible causes

The security rule condition does not match the user auth state or custom claims
The rule references a field that does not exist on the document
The rule uses request.auth.uid but the user is anonymous

Diagnosis steps

Test the rule in the Firebase console simulator

firebase firestore:rules --test

Interpretation

The simulator shows which rule matches and why it denies access.

Check the user auth state

console.log(await auth.currentUser)

Interpretation

Confirm the user is signed in and has the expected claims.

Root cause

The Firestore security rules evaluate to false for the request, so the server rejects the read or write with permission-denied.

Fix

Update the security rules to allow the access pattern, ensure the rule condition matches the user auth state, and deploy the updated rules.

Verify the fix

Retry the document access from the client and confirm it succeeds; verify unauthorized users are still blocked.

Symptom walkthrough

Firestore returns permission-denied because the security rules do not allow the authenticated user to read or write the requested document or collection. The error appears in production but may not surface in local development because the conditions that trigger it depend on the deployment environment or runtime configuration. Understanding the full symptom set helps distinguish this issue from similar errors.

Diagnosis in practice

Follow the diagnosis steps in the frontmatter to isolate the cause. Each step includes a command and an interpretation of the output. The goal is to narrow down whether the issue is in the configuration, the runtime, or the application code. Reproduce the error in a minimal setup before applying a fix.

Root cause

The Firestore security rules evaluate to false for the request, so the server rejects the read or write with permission-denied.

Fix

Update the security rules to allow the access pattern, ensure the rule condition matches the user auth state, and deploy the updated rules. After applying the fix, monitor the system to confirm the error does not recur under load or in different environments.

Verification

Retry the document access from the client and confirm it succeeds; verify unauthorized users are still blocked. If the verification passes, the fix is confirmed; if not, re-examine the diagnosis steps for missed contributing factors.

Diagnostic commands

Run these commands to reproduce and diagnose the issue:

firebase firestore:rules --test
console.log(await auth.currentUser)