← BlogError explained3 min readUpdated 2026-08-03

"Missing or insufficient permissions" in Firebase — what it means

Firestore is denying the request on purpose. The wrong fix here opens your whole database.

What it means

Your Firestore security rules evaluated the request and denied it. The client SDK surfaces this as FirebaseError: Missing or insufficient permissions. Nothing is broken — a rule said no.

Why it happens in AI-built apps

  • Test mode expired. Firebase grants open access for a limited period when you create a project, then closes it.
  • The rule checks request.auth but the read runs before sign-in completes, so request.auth is null.
  • A create is being checked against resource.data, which does not exist yet — creates must validate request.resource.data.
  • The rule requires a field the document does not have, such as userId on documents written before that field existed.

Is this error actually a problem?

Check it yourself

Test the rule in the Rules Playground

  1. 1Firebase console → Firestore → Rules → Rules Playground.
  2. 2Set the request type to match what your app does, and leave authentication off.
  3. 3Run it against the collection — it should be denied.
  4. 4Now simulate an authenticated user reading a document owned by someone else. Also denied.
  5. 5If either succeeds, your rules are open and the error you are seeing is unrelated.

Fix it

Copy this into your AI coding tool
I get "Missing or insufficient permissions" from Firestore.

1. Show me the rule that is denying the request and explain which
   condition fails.
2. Tell me whether the operation is a read, create, update or delete —
   creates must be validated against request.resource.data, not
   resource.data, and this is the most common mistake.
3. Fix the rule so the legitimate case works while everything else stays
   denied, for example:
     match /items/{id} {
       allow read, update, delete: if request.auth != null
         && request.auth.uid == resource.data.userId;
       allow create: if request.auth != null
         && request.auth.uid == request.resource.data.userId;
     }
4. Check whether the client is querying before authentication resolves; if
   so, fix the ordering rather than loosening the rule.

Do NOT suggest allow read, write: if true, even temporarily. If my query
cannot be satisfied without opening the collection, tell me why.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free