能否通过Firestore安全规则验证签名允许文档创建，或需用Cloud Functions？

Great question! Let's break down the options clearly:

Firestore Security Rules Can't Directly Verify Asymmetric Signatures #

Unfortunately, you can't perform asymmetric signature verification directly within Firestore security rules. Here's why:

• Firestore security rules are built for lightweight checks—like validating field presence, user auth status, or basic data formats—rather than complex cryptographic operations.
• The rule language doesn't include built-in functions for verifying signatures using public/private key pairs (there’s no equivalent of a verifySignature(publicKey, data, signature) method). There’s no way to execute the cryptographic logic needed to confirm the signature matches the provided data and public key within the rule environment.

You Must Use Cloud Functions (or a Server-Side Service) for Verification #

The reliable, secure approach here is to offload the signature verification to a server-side process like Cloud Functions:

1. Client sends data to the function: Have your client app send the publicKey, data, and signature to a Cloud Functions Callable or HTTP function.
2. Verify the signature server-side: Use a cryptographic library (like Node.js's built-in crypto module) to validate that the signature was generated with the private key corresponding to the provided publicKey and data.
3. Write to Firestore only if valid: If verification passes, the function creates the document in your Firestore collection on behalf of the client. If it fails, return an error and skip writing the data.
4. Lock down Firestore rules: Update your Firestore security rules to only allow writes from the Cloud Functions service account (block direct client writes), ensuring all data goes through your verification step.

This setup guarantees that only valid, properly signed data enters your Firestore collection, since the critical verification logic runs in a controlled server environment.

内容的提问来源于stack exchange，提问作者Hamza Ezzaydia