title: Firestore client set() and field schema validation
body: <p>I am creating a react native application using Firestore and I am not sure how to implement secure schema validation on <a href="https://firebase.google.com/docs/firestore/manage-data/add-data" rel="nofollow noreferrer">document creation</a> and update.</p>
  
  <p>If I understand security rules, it is possible to: </p>
  
  <ul>
  <li>Limit who can perform operations (update, read, write, etc.) on documents</li>
  <li>Limit operations allowed based on field conditionals</li>
  <li>Limit operations allowed based on custom functions (<a href="https://fireship.io/snippets/firestore-rules-recipes/" rel="nofollow noreferrer">post w/ examples</a>)</li>
  </ul>
  
  <p>My concern is that because of the client side nature of the requests, a savvy user could utilize their authentication and some client side code to .set() any field or map/object to any value they want unless a security rule prevents it. It appears I could use very complicated custom functions to validate the data received. I could also validate every update and create through a Cloud Function API, but I am attempting to use the Firestore database itself whenever possible.</p>
  
  <p>Am I right to be concerned about the potential for users to abuse their .set() field creation abilities on authorized documents (i.e. documents with minimal userId rules)? </p>
  
  <p>Is there an accepted way to create security rules that prevent client abuse of documents that don't have custom functions that validate the schema?</p>