Can I just allow all reads and writes?

Not in a real app. The bucket would accept files from anyone and hand every file to anyone. Firebase strongly recommends restricting access and setting up robust security rules, especially for production apps.

What is storage/unauthenticated, then?

A different code. Firebase’s message for storage/unauthenticated is “User is unauthenticated, please authenticate and try again.” storage/unauthorized means your security rules refused the request. A rule like request.auth != null can produce the second one if sign-in hasn’t finished, so check both.

Can you fix it for me?

Yes. The Firebase Security Rules Audit covers Firestore and Storage rules, tests whether one user can read or change another user’s files, and fixes what it finds in a pull request; production is never touched. If one upload screen is the whole problem, the App Fix Ticket covers it.

Firebase Storage Unauthorized Error: The Fix

Short answer

Your Cloud Storage Security Rules rejected the request. Check three things: the rules allow this action for this user, the user is signed in before the upload starts, and the file path matches the path in the rule, such as a folder named after the user’s uid. Don’t fix it by allowing everyone: Firebase strongly recommends restricting access.

Why Storage says no, and the fix

01
The rules don’t allow this action
“User is not authorized to perform the requested action, check your security rules to ensure they are correct.” Firebase, Handle errors
By default a bucket requires Firebase Authentication for every read and write. If your rules are stricter, or were written for another folder, the request is refused. Read the rules in the Firebase console under Storage, then Rules, and compare them with the path and user in the failing request.
02
The upload starts before sign-in has finished
“currentUser might also be null because the auth object has not finished initializing.” Firebase, Manage users
When the user isn’t signed in yet, request.auth is null and a rule like request.auth != null refuses the upload. Code that runs on page load can start before Firebase Auth has restored the user. Wait for onAuthStateChanged to report a user before reading or writing files.
03
The path doesn’t match the rule
“Cloud Storage lets you specify per file and per path authorization rules that live on our servers and determine access to the files in your app.” Firebase, Security Rules for Cloud Storage
Rules are written per path. A common pattern lets each user write only under their own uid, so an upload to another folder, or with a different uid in the path, is refused. Make the path in the code match the rule exactly. Firebase’s example:
```
// Only a user can upload their profile picture, but anyone can view it
match /users/{userId}/profilePicture.png {
  allow read;
  allow write: if request.auth.uid == userId;
}
```

Checked against the vendor’s docs on November 1, 2026: Firebase docs: Handle errors for Cloud Storage; Firebase docs: Security Rules for Cloud Storage; Firebase docs: Rules conditions for Cloud Storage; Firebase docs: Manage users on the web.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Firebase Storage errorFirebase Storage “storage/unauthorized” error

Why Storage says no, and the fix

The rules don’t allow this action

The upload starts before sign-in has finished

The path doesn’t match the rule

Rather hand it over?

More on this error

Describe it and get a written quote