How to fix storage/permission-denied in Firebase

FirebaseBEGINNERHIGHUpdated Dec 22, 2025· 174 views

This error occurs when your app lacks the necessary permissions to read or write files in Firebase Cloud Storage. Learn how to authenticate users, configure security rules, and fix access issues in your Firebase project.

Quick fix

Fixes storage/permission-denied

import { getAuth, signInAnonymously } from 'firebase/auth';
import { getStorage, ref, uploadBytes } from 'firebase/storage';

const auth = getAuth();
const storage = getStorage();

// First, sign in the user (or use an existing session)
if (!auth.currentUser) {
  await signInAnonymously(auth);
}

// Now upload is allowed by the rules
const storageRef = ref(storage, 'files/myfile.txt');
await uploadBytes(storageRef, file);
  1. Ensure user is authenticated before accessing storage
  2. Review your Firebase Security Rules
  3. Allow unauthenticated access if appropriate (test only)
  4. Implement path-based access control for authenticated users
firebase — error
import { getAuth, signInAnonymously } from 'firebase/auth';
import { getStorage, ref, uploadBytes } from 'firebase/storage';
const auth = getAuth();
const storage = getStorage();
// First, sign in the user (or use an existing session)
if (!auth.currentUser) {
  await signInAnonymously(auth);
}
// Now upload is allowed by the rules
const storageRef = ref(storage, 'files/myfile.txt');
await uploadBytes(storageRef, file);
storage/permission-denied

What this error means

The "storage/permission-denied" error is Firebase Cloud Storage's way of protecting your data when access is not allowed. This happens when a user tries to perform an operation (read or write) on a storage file but the current Firebase Security Rules do not permit the action. The error is typically caused by one of three scenarios: the user is not authenticated, the security rules do not match the user's identity, or the rules explicitly block the requested operation. Firebase Cloud Storage always enforces these rules on the client side to prevent unauthorized access to your files.

Typical symptoms

  • Upload fails with "Permission denied" message when trying to save files
  • Download fails when attempting to retrieve files from storage
  • Error message appears: "User does not have permission to access this object"
  • HTTP 403 error in browser console or app logs
  • Mobile app or web app cannot read/write files in storage

Common causes

  1. User is not authenticated (not signed in to Firebase Authentication)
  2. Firebase Security Rules require authentication but user is anonymous
  3. Security rules explicitly deny the operation (read or write) for this user
  4. Path-based rules check user ID in path but user's UID doesn't match
  5. Default security rules are still in place (they deny all unauthenticated access)
  6. Security rules were misconfigured or use incorrect syntax

How to fix "storage/permission-denied"

1Ensure user is authenticated before accessing storage

The most common cause is that the user is not signed in. Check if the user is authenticated before attempting to read or write:

javascript
import { getAuth, signInAnonymously } from 'firebase/auth';
import { getStorage, ref, uploadBytes } from 'firebase/storage';

const auth = getAuth();
const storage = getStorage();

// First, sign in the user (or use an existing session)
if (!auth.currentUser) {
  await signInAnonymously(auth);
}

// Now upload is allowed by the rules
const storageRef = ref(storage, 'files/myfile.txt');
await uploadBytes(storageRef, file);
2Review your Firebase Security Rules

Go to the Firebase Console > Storage > Rules and check the current rules. The default rules require authentication:

bash
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

These rules mean: "Allow read and write ONLY if user is authenticated (request.auth is not null)". If your user is not signed in, the rules block the request.

3Allow unauthenticated access if appropriate (test only)

For development or public files, you can temporarily allow unauthenticated access. Warning: Only use this for testing or public files. This is insecure in production:

bash
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if true;
    }
  }
}

Always secure this again before launching to production.

4Implement path-based access control for authenticated users

Use user IDs in your storage paths to restrict access. This allows only the owner to access their files:

bash
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Allow users to read/write only their own files
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

In your code, structure your upload paths with the user ID:

javascript
const userId = auth.currentUser.uid;
const storageRef = ref(storage, `users/${userId}/myfile.txt`);
await uploadBytes(storageRef, file);
5Catch and handle the error in your code

Add error handling to gracefully handle permission denied errors:

javascript
import { getStorage, ref, uploadBytes } from 'firebase/storage';

try {
  const storageRef = ref(storage, 'files/myfile.txt');
  await uploadBytes(storageRef, file);
  console.log('Upload successful');
} catch (error) {
  if (error.code === 'storage/unauthorized' || error.code === 'storage/permission-denied') {
    console.error('Permission denied. Make sure you are signed in.');
    // Redirect user to login or show error message
  } else {
    console.error('Upload failed:', error.message);
  }
}
6Test with Firebase Emulator Suite (optional)

Use the Firebase Emulator to test your rules locally without affecting production:

bash
firebase emulators:start

This lets you debug security rules and authentication flows before deploying to production. You can also check rule evaluation in the Firebase Console under Storage > Rules > Simulate.

Advanced notes

If using the Firebase Admin SDK on a backend server, security rules are bypassed completely—all operations are allowed. Permission denied errors only apply to web and mobile clients. For fine-grained access control, consider implementing custom claims in Firebase Auth tokens and checking them in your rules. If you are using different storage buckets, verify you are accessing the correct bucket. Some users experience permission denied even with correct rules due to cached tokens—try signing out and signing back in. You can also use custom authentication tokens (from your backend) to grant specific permissions to users.

Frequently asked questions

What does "storage/permission-denied" mean?
The "storage/permission-denied" error is Firebase Cloud Storage's way of protecting your data when access is not allowed. This happens when a user tries to perform an operation (read or write) on a storage file but the current Firebase Security Rules do not permit the action. The error is typically caused by one of three scenarios: the user is not authenticated, the security rules do not match the user's identity, or the rules explicitly block the requested operation.
How do I fix "storage/permission-denied"?
This error occurs when your app lacks the necessary permissions to read or write files in Firebase Cloud Storage. Learn how to authenticate users, configure security rules, and fix access issues in your Firebase project.
What causes "storage/permission-denied"?
User is not authenticated (not signed in to Firebase Authentication) Firebase Security Rules require authentication but user is anonymous Security rules explicitly deny the operation (read or write) for this user
Is the "storage/permission-denied" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading