How to Protect Your FlutterFlow App from Unauthorized Access

In FlutterFlow, go to Settings (gear icon, bottom of left sidebar) → App Settings → Authentication. Toggle on Enable Authentication. You will see two drop-downs: Entry Page (the page unauthenticated users land on — typically your Login or Welcome page) and Logged In Page (the page authenticated users see on app start — typically your Home or Dashboard page). FlutterFlow automatically wraps your entire app in an authentication gate that checks Firebase Auth state on every app start. If the user is not signed in, they see the Entry Page. If they are signed in, they skip to Logged In Page. This single setting prevents any unauthenticated user from reaching your app's content pages.

The global Authentication Gate handles unauthenticated users, but authenticated users may still reach pages they should not access — for example, a regular user reaching the Admin Panel via a deep link. For each sensitive page, add an On Page Load action. Select the page in FlutterFlow, open the Action Flow Editor, and add a Conditional action: if currentUser is null OR if the user's role (stored in a Firestore users document) does not equal the required role, then navigate to the appropriate fallback page (Home or Unauthorized). This check runs every time the page loads, including when accessed via deep link or back navigation. For admin pages, query the user's Firestore document in the same On Page Load action and check the role field.

FlutterFlow's route protection blocks navigation, but it does not prevent a malicious user from calling the Firestore API directly to read or write another user's data. Open the Firebase Console, go to Firestore Database, and click the Rules tab. Write rules that check both authentication and document ownership. Every user-owned collection should require request.auth != null (authenticated) and resource.data.userId == request.auth.uid (owns the document). For role-based collections like admin_logs, require request.auth.token.admin == true. Publish the rules. Test them using the Rules Playground by simulating read and write requests as different users.

1rules_version = '2';
2service cloud.firestore {
3  match /databases/{database}/documents {
4
5    // Only signed-in users can read their own profile
6    match /users/{userId} {
7      allow read, update: if request.auth != null && request.auth.uid == userId;
8      allow create: if request.auth != null && request.auth.uid == userId;
9      allow delete: if false; // Prevent accidental deletion
10    }
11
12    // User-owned data: read/write own documents only
13    match /{collection}/{docId} {
14      allow read: if request.auth != null
15        && resource.data.userId == request.auth.uid;
16      allow create: if request.auth != null
17        && request.resource.data.userId == request.auth.uid;
18      allow update: if request.auth != null
19        && resource.data.userId == request.auth.uid
20        && request.resource.data.userId == request.auth.uid;
21      allow delete: if request.auth != null
22        && resource.data.userId == request.auth.uid;
23    }
24
25    // Admin-only: requires custom claim
26    match /admin_logs/{docId} {
27      allow read, write: if request.auth != null
28        && request.auth.token.admin == true;
29    }
30
31    // Default: deny everything else
32    match /{document=**} {
33      allow read, write: if false;
34    }
35  }
36}

Any Cloud Function that accesses sensitive data or performs privileged operations must verify the caller's Firebase Auth token. In callable Cloud Functions (recommended), Firebase automatically verifies the token and exposes it as context.auth. In HTTP functions, you must manually verify using admin.auth().verifyIdToken(). In FlutterFlow, always use callable Cloud Functions (type: onCall) rather than HTTP functions — FlutterFlow's Cloud Function action type handles token passing automatically. Add a check at the top of every callable function: if (!context.auth) throw HttpsError('unauthenticated', 'Login required'). For admin-only functions, additionally check context.auth.token.admin === true.

On shared devices or kiosk-style deployments, a signed-in session should expire after a period of inactivity. In FlutterFlow, create an App State variable lastActivityTime (DateTime). Add an On Tap action wrapper component that updates lastActivityTime on every user interaction. On each page's On Page Load action, add a check: if DateTime.now() minus lastActivityTime is greater than 15 minutes, call the Firebase Auth Sign Out action and navigate to the Login page. For more robust detection, use a Custom Action with a Timer that fires every minute and checks the inactivity duration. Show a warning dialog at 13 minutes ('You will be signed out in 2 minutes due to inactivity') with a Stay Logged In button that resets lastActivityTime.