Should I set the rules to allow read, write: if true to make the error go away?

No. That lets anyone on the internet read and change every document in the database. Fix the query or the rule for the one request that fails, and keep everything else locked.

It works in the emulator but fails in production. Why?

The emulator runs the rules file listed in firebase.json, which may not match what’s deployed. Production runs whatever was last deployed. Deploy the rules you tested, then wait up to a minute before trying again.

Only one user gets the error. Why?

Their data probably breaks an assumption in the rules, such as a missing ownerId field or a role stored somewhere the rule doesn’t look. Run that user’s exact request in the Rules Playground with their user ID and the document’s data.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

Firebase "Missing or Insufficient Permissions" Fix

Short answer

Usually the query asks for more than the rules allow. Firestore rules are not filters: if a query could return even one document the user can’t read, the whole query fails. Add the same conditions to the query that the rule checks. Next most likely: no user is signed in yet when the request runs.

The usual causes, and the fix

01
The query doesn’t match the rule
If the rule only allows documents where ownerId equals the user’s ID, the query must filter on ownerId too. A query for the whole collection fails even if every document in it happens to be the user’s. The same goes for limits: if the rule checks request.query.limit, the query needs a limit that passes.
```
// rule: allow read: if resource.data.ownerId == request.auth.uid;
query(collection(db, 'projects'), where('ownerId', '==', user.uid));
```
02
No user is signed in yet
Rules that check request.auth.uid fail when the request runs before sign-in finishes, or after the session ends. Start Firestore reads after the auth state listener reports a signed-in user, not on page load.
03
The rules really do deny it
Check the deployed rules, not the file on your laptop. If they compare request.time with a fixed date, they stop allowing anything once that date passes. Then try the exact request in the Rules Playground in the Firebase console, which tests the rules in its editor, so start from the deployed version. Unit tests against the emulator work too. After you deploy new rules, allow up to a minute for new queries and up to 10 minutes for open listeners.
04
App Check enforcement is on
Once App Check enforcement is on for Firestore, requests without a valid App Check token are rejected. If the error started when enforcement was turned on, set up App Check in the client, including a debug token for local testing.

Checked against the vendor’s docs on October 30, 2026: Firebase docs: Securely query data; Firebase docs: Get started with Cloud Firestore Security Rules; Firebase docs: Quickly validate Firebase Security Rules; Firebase docs: Enable App Check enforcement.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Free Firebase rules checker

Firebase Firestore errorFirebaseError: Missing or insufficient permissions

The usual causes, and the fix

The query doesn’t match the rule

No user is signed in yet

The rules really do deny it

App Check enforcement is on

Rather hand it over?

More on this error

Describe it and get a written quote