How to fix storage/unauthorized: User does not have permission to access this object. in Firebase

First, confirm that your user is properly authenticated before attempting Storage operations. Check whether authentication is actually required by your security rules.

import { getAuth, onAuthStateChanged } from "firebase/auth";

const auth = getAuth();
onAuthStateChanged(auth, (user) => {
  if (user) {
    console.log("User authenticated:", user.uid);
    console.log("User email:", user.email);
  } else {
    console.log("User not authenticated");
  }
});

If the user is not authenticated and your rules require authentication, implement sign-in before attempting Storage operations:

import { signInAnonymously } from "firebase/auth";

try {
  const result = await signInAnonymously(auth);
  console.log("Anonymous sign-in successful:", result.user.uid);
} catch (error) {
  console.error("Sign-in failed:", error);
}

Navigate to the [Firebase Console](https://console.firebase.google.com/), select your project, go to Storage, and click the Rules tab at the top.

Look at your current rules and understand what access they grant. Common rule patterns:

Allow all reads/writes (test mode only - not for production):

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write;
    }
  }
}

Allow only authenticated users:

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

Allow users to only access their own files:

service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

If your rules are too restrictive, you will receive the storage/unauthorized error. Note that "test mode" rules are temporary and expire after 30 days.

If your rules check request.auth != null (authenticated users only), ensure your user is signed in before accessing Storage.

Important: request.auth is specifically for Firebase Authentication. If you're not using Firebase Authentication, request.auth will always be null, and authenticated-only rules will deny access.

Sign in your user with Firebase Authentication:

import { getAuth, signInWithEmailAndPassword } from "firebase/auth";

const auth = getAuth();
try {
  const userCredential = await signInWithEmailAndPassword(auth, email, password);
  console.log("Signed in:", userCredential.user.uid);
} catch (error) {
  console.error("Sign-in error:", error.code);
}

After successful sign-in, Firebase will automatically include the user's authentication token in Storage requests, and your rules can verify request.auth != null.

If your rules restrict access to specific paths (e.g., user/{userId}/...), ensure your code accesses files using the correct path structure.

Rule example:

match /users/{userId}/{allPaths=**} {
  allow read, write: if request.auth.uid == userId;
}

Correct code (accessing own files):

import { getStorage, ref, uploadBytes } from "firebase/storage";
import { getAuth } from "firebase/auth";

const auth = getAuth();
const storage = getStorage();
const user = auth.currentUser;

if (user) {
  // Upload to user-specific path
  const storageRef = ref(storage, `users/${user.uid}/myfile.txt`);
  await uploadBytes(storageRef, file);
}

Incorrect code (different path):

// This will fail because it doesn't match users/{uid}/... pattern
const storageRef = ref(storage, `files/myfile.txt`);
await uploadBytes(storageRef, file); // ✗ storage/unauthorized

Ensure your file references match the path structure defined in your security rules.

The Firebase Console includes a Rules Playground to test your security rules without affecting your live app.

1. Open the Rules tab in the Storage section
2. Click Rules Playground or scroll down to see the playground panel
3. Select your simulation settings:
- Authentication: Choose "Custom token" or "None"
- For "Custom token", enter a user UID
- Resource path: Enter the full path you're trying to access (e.g., users/abc123/file.txt)
- Operation: Select "read" or "write"
4. Click Run to simulate the request

The playground will show whether your rule allows or denies the operation and why. This helps identify if path matching or authentication checks are the issue.

For more thorough testing, use the [Firebase Local Emulator Suite](https://firebase.google.com/docs/emulator-suite):

npm install -D @firebase/rules-unit-testing
firebase emulators:start

This allows you to test your rules in a local environment before deploying to production.

Once you've identified the issue, update your rules to allow the necessary operations.

Example: Allow authenticated users to read and write:

service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

Example: User-specific paths with role-based access:

service firebase.storage {
  match /b/{bucket}/o {
    // Users can access their own folders
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth.uid == userId;
    }
    // Public files anyone can read
    match /public/{allPaths=**} {
      allow read;
      allow write: if request.auth != null && request.auth.token.admin == true;
    }
  }
}

After updating:
1. Click Publish in the Firebase Console
2. Confirm the deployment (rules take effect immediately, within seconds)
3. Test your app again - the storage/unauthorized error should be resolved

Be careful with overly permissive rules in production. Always follow the principle of least privilege.