Storage Rules and Custom Tokens

[blaforet]

Hi
I'm able to upload the files to firebase storage, I then store the data information in firestore document.
But i have difficulty with the Storage Rules. No matter what rules i put, the url given by snapshot.downloadURL make the document accessible from any computer/device, logged in or not, no matter what.

Rules:
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth.uid == 'blabla';
}
match /users/{userId} {
allow read, write: if request.auth.token.premiumAccount == true;
}
}}

URL Example

Look like the token provided by the snapshot.downloadURL surpass all storage rules.

Custom Token
I've created the a cloud function that generate a Custom Token and when i change that token for my new custom token, i get an error 403, permission denied.

I must do something wrong.
Any suggestion?

Thank you

[jhuleatt]

This issue in the JS SDK has lots of discussion on this topic, as well as some suggested workarounds.