How Can I Troubleshoot Common FlutterFlow Security Problems

When a Firestore read or write fails silently in FlutterFlow, the first tool to use is the Firebase console's Rules Monitor. Go to Firestore > Rules > Monitor rules. Enable monitoring and reproduce the failing action in your app. The Monitor shows every rules evaluation in real time — the request path, the requesting UID, and whether the rule allowed or denied the request. Find the denied request and look at the `allow` condition that failed. Most permission denied errors fall into three categories: (1) the user is not authenticated (`request.auth == null`), (2) the UID does not match the document's `ownerId` field, or (3) a new collection was added to the app but no rule was written for it yet. Fix the specific rule that failed — do not broaden all rules to compensate.

If users can see each other's data — another user's profile, private documents, or payment history — the most common cause is Firestore rules using `allow read: if true` or a missing ownership check. In the Firebase console, go to Firestore > Rules and search for any rule that contains `if true` or `allow read;` without a condition. Replace these with explicit conditions. For user-owned data, the correct pattern is `allow read: if request.auth != null && request.auth.uid == resource.data.ownerId`. Also check list (collection-level) queries — a document-level rule that passes does not protect against a query that returns all documents in the collection. Add query constraints in your Firestore Security Rules to validate query filters match the authenticated user.

1rules_version = '2';
2service cloud.firestore {
3  match /databases/{database}/documents {
4
5    // WRONG — allows anyone to read any user document
6    // match /users/{userId} {
7    //   allow read: if true;
8    // }
9
10    // CORRECT — user can only read their own document
11    match /users/{userId} {
12      allow read, write: if request.auth != null
13        && request.auth.uid == userId;
14    }
15
16    // CORRECT — user can only query their own documents
17    match /orders/{orderId} {
18      allow read: if request.auth != null
19        && resource.data.userId == request.auth.uid;
20
21      // Validate query constraints match authenticated user
22      allow list: if request.auth != null
23        && request.query.filters['userId'] == request.auth.uid;
24    }
25  }
26}

If you have accidentally committed an API key to GitHub, embedded it in a FlutterFlow API Manager header visible in the app binary, or shared it in a screenshot, treat it as compromised immediately. For Firebase API keys: go to the Google Cloud console > APIs and Services > Credentials, find the exposed key, and click Edit to restrict it by IP, referrer, or app bundle ID. Firebase web API keys cannot be fully secret (they are embedded in Firebase config), so the real protection is Firebase Security Rules and App Check — not key secrecy. For third-party API keys (Stripe, OpenAI): go to that provider's dashboard and revoke the exposed key, create a new key, and store the new key as a Firebase Function Secret. Move the API call from FlutterFlow API Manager to a Cloud Function.

Firebase App Check verifies that requests to Firebase services come from your legitimate app, not scripts or bots. When enabled, it can reject requests from legitimate sources in two common cases: (1) during FlutterFlow development, the preview runs in a browser environment that does not have your app's debug attestation token, and (2) after updating your app's bundle ID or SHA certificate fingerprint without updating App Check. For development, go to the Firebase console > App Check > Apps, find your app, and click Add debug token. Copy the debug token and add it to your FlutterFlow app's App Check configuration. For production issues, ensure your iOS app's App Attest key ID and Android app's Play Integrity API are correctly configured in App Check settings.

Cross-Origin Resource Sharing (CORS) errors appear when your FlutterFlow web app calls a Cloud Function that does not include the correct `Access-Control-Allow-Origin` response header. In the Cloud Function, install the `cors` npm package and wrap your HTTP function handler. For callable functions (`onCall`), Firebase handles CORS automatically — you only need to add CORS headers for HTTP functions (`onRequest`). If you are seeing CORS errors on a callable function, the issue is usually not CORS — it is an authentication error or function not found. Check the browser console for the actual error message behind the CORS error.

1// For onRequest HTTP functions that need CORS
2const { onRequest } = require('firebase-functions/v2/https');
3const cors = require('cors')({ origin: true });
4
5exports.myHttpFunction = onRequest((req, res) => {
6  cors(req, res, () => {
7    // Handle request after CORS headers are set
8    if (req.method === 'OPTIONS') {
9      res.status(204).send('');
10      return;
11    }
12    res.json({ message: 'Hello' });
13  });
14});
15
16// onCall functions handle CORS automatically — no cors package needed
17// If you see a CORS error on onCall, check:
18// 1. Is the function deployed? (test with firebase functions:list)
19// 2. Is the user authenticated? (onCall returns 401 without auth)
20// 3. Is the function name spelled correctly in FlutterFlow?

Firebase ID tokens expire after one hour. In a long-running FlutterFlow session, an expired token causes Firestore reads and Cloud Function calls to fail with permission denied or unauthenticated errors. FlutterFlow's Firebase integration automatically refreshes tokens in the background for most cases, but issues can occur on mobile after the app is backgrounded for a long time. In FlutterFlow, add an action on the App Foreground event (Settings > App Settings > On App Foreground) that calls a Custom Action to force-refresh the Firebase ID token: `await FirebaseAuth.instance.currentUser?.getIdToken(true)`. The `true` parameter forces a refresh even if the current token is not yet expired. Also check that your Cloud Functions are not caching old auth tokens — if you pass the token as a header manually, refresh it before each request.

1// Custom Action: refreshAuthToken
2import 'package:firebase_auth/firebase_auth.dart';
3
4Future refreshAuthToken() async {
5  final user = FirebaseAuth.instance.currentUser;
6  if (user != null) {
7    await user.getIdToken(true); // force = true refreshes immediately
8  }
9}