Cloud Firestore敏感用户数据访问权限拆分方案选型咨询

Great question! When it comes to securing sensitive user data in Firestore (I’m assuming this is Firestore given your reference to collections and security rules), both approaches you’ve outlined have their pros and cons, but one is generally preferred—and there’s a third option that might be even better depending on your use case. Let’s break this down:

Option 1: Top-level SensitiveUserData collection (matching User document IDs) #

This is the most commonly recommended approach for isolating sensitive data, and here’s why:

• Clear permission boundaries: You can set security rules directly on the entire SensitiveUserData collection, making it trivial to restrict access to only specific trusted clients or authenticated users who need it. No need to mess with nested paths or inherited rules.
• Bandwidth efficiency: Regular queries to the Users collection won’t pull in sensitive data by default, which saves bandwidth and reduces unnecessary data transfer for clients that don’t need the sensitive info.
• Auditability: Separating sensitive data into its own collection makes it easier to track access (via Firestore Audit Logs, for example) since all sensitive data operations are contained in one place.

The main downside is that you’ll need to fetch the sensitive data in a separate query using the same document ID as the user’s main profile. But this is a small tradeoff for the security and clarity it provides.

Option 2: SensitiveUserData subcollection under each User document (single document) #

This approach is less ideal for most cases:

• Unnecessary complexity: Subcollections are designed for one-to-many relationships, so using one to hold a single document feels like a misuse of the data model. You’ll have to deal with querying a collection and then limiting results to 1 every time you need the sensitive data.
• Permission overhead: While you can set rules for the subcollection, they’re slightly more verbose since you have to reference the parent User document’s ID or attributes. It’s not impossible, but it adds unnecessary layers to your rule set.

Unless you have a specific reason to group the sensitive data under the user’s document (like needing transactional writes across both the User and sensitive data), this approach doesn’t offer meaningful benefits over the top-level collection.

Option 3: Field-level security rules in the User document #

If your sensitive data consists of specific fields (rather than a large block of data), you can skip splitting collections entirely and use Firestore’s field-level security rules to protect only the sensitive parts of the User document.

For example, your rule might look like this:

match /users/{userId} {
  // Allow all clients to read public fields
  allow read: if request.auth.uid == userId || request.app.id in ['public-client-id'];
  
  // Only allow trusted clients to read sensitive fields
  allow read: if request.app.id in ['trusted-client-1', 'trusted-client-2']
              && request.resource.data.keys().hasOnly(['name', 'email', 'phone', 'ssn']);
}

This approach is great if:

• You don’t want to manage multiple collections
• The sensitive data is just a few fields rather than an entire document’s worth
• You want to fetch both public and sensitive data in a single query (for authorized clients)

Which should you choose? #

In most cases, Option 1 (top-level SensitiveUserData collection) is the best choice. It provides clean separation, straightforward permissions, and aligns with Firestore’s best practices for data isolation.

If your sensitive data is just a handful of fields and you prefer a simpler data model, Option 3 (field-level rules) is a strong alternative.

Option 2 is rarely the right pick unless you have a very specific edge case that requires the subcollection structure.

内容的提问来源于stack exchange，提问作者Jeroen van de Ven