How to fix storage/permission-denied in Firebase

FirebaseBEGINNERHIGH

This error occurs when your app lacks the necessary permissions to read or write files in Firebase Cloud Storage. Learn how to authenticate users, configure security rules, and fix access issues in your Firebase project.

What this error means

The "storage/permission-denied" error is Firebase Cloud Storage's way of protecting your data when access is not allowed. This happens when a user tries to perform an operation (read or write) on a storage file but the current Firebase Security Rules do not permit the action. The error is typically caused by one of three scenarios: the user is not authenticated, the security rules do not match the user's identity, or the rules explicitly block the requested operation. Firebase Cloud Storage always enforces these rules on the client side to prevent unauthorized access to your files.

How to fix "storage/permission-denied"

1Ensure user is authenticated before accessing storage

The most common cause is that the user is not signed in. Check if the user is authenticated before attempting to read or write:

javascript

import { getAuth, signInAnonymously } from 'firebase/auth';
import { getStorage, ref, uploadBytes } from 'firebase/storage';

const auth = getAuth();
const storage = getStorage();

// First, sign in the user (or use an existing session)
if (!auth.currentUser) {
  await signInAnonymously(auth);
}

// Now upload is allowed by the rules
const storageRef = ref(storage, 'files/myfile.txt');
await uploadBytes(storageRef, file);

2Review your Firebase Security Rules

Go to the Firebase Console > Storage > Rules and check the current rules. The default rules require authentication:

bash

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

These rules mean: "Allow read and write ONLY if user is authenticated (request.auth is not null)". If your user is not signed in, the rules block the request.

3Allow unauthenticated access if appropriate (test only)

For development or public files, you can temporarily allow unauthenticated access. Warning: Only use this for testing or public files. This is insecure in production:

bash

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if true;
    }
  }
}

Always secure this again before launching to production.

4Implement path-based access control for authenticated users

Use user IDs in your storage paths to restrict access. This allows only the owner to access their files:

bash

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    // Allow users to read/write only their own files
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

In your code, structure your upload paths with the user ID:

javascript

const userId = auth.currentUser.uid;
const storageRef = ref(storage, `users/${userId}/myfile.txt`);
await uploadBytes(storageRef, file);

5Catch and handle the error in your code

Add error handling to gracefully handle permission denied errors:

javascript

import { getStorage, ref, uploadBytes } from 'firebase/storage';

try {
  const storageRef = ref(storage, 'files/myfile.txt');
  await uploadBytes(storageRef, file);
  console.log('Upload successful');
} catch (error) {
  if (error.code === 'storage/unauthorized' || error.code === 'storage/permission-denied') {
    console.error('Permission denied. Make sure you are signed in.');
    // Redirect user to login or show error message
  } else {
    console.error('Upload failed:', error.message);
  }
}

6Test with Firebase Emulator Suite (optional)

Use the Firebase Emulator to test your rules locally without affecting production:

bash

firebase emulators:start

This lets you debug security rules and authentication flows before deploying to production. You can also check rule evaluation in the Firebase Console under Storage > Rules > Simulate.

How to fix storage/permission-denied in Firebase

What this error means

Typical symptoms

Common causes

How to fix "storage/permission-denied"

Advanced notes

Related errors

Official resources & further reading