title: Firebase Storage Security Rules
body: <p>I am using fire base storage for my application which connects to front end.
  My current storage rules for only of the bucket folders is :</p>
  <pre><code>match {groupID}/{userId}/{image} {
          allow read: if isValidProvider() &amp;&amp; request.auth.token.groupId == groupID &amp;&amp; request.auth.uid == userId;
          allow write: if isValidProvider() &amp;&amp; request.auth.uid == userId &amp;&amp;  request.auth.token.groupId== groupID &amp;&amp; isImageValid() &amp;&amp; isValidImageExtension(image);
        }
      }  
  </code></pre>
  <p>Functions are as below :</p>
  <pre><code>function isImageValid(){
      return (request.resource.contentType.matches('image/png') ||
          request.resource.contentType.matches('image/jpg') ||
          request.resource.contentType.matches('image/jpeg') ||
          request.resource.contentType.matches('image/webp') ||
            request.resource.contentType.matches('image/gif'));
          
    }
  
  
  
    function isValidImageExtension(image) {
    return (image.matches('.*[.]png') || 
        image.matches('.*[.]jpeg') ||
        image.matches('.*[.]jpg') ||
        image.matches('.*[.]webp')||
        image.matches('.*[.]gif'));
    }
  </code></pre>
  <p>My intention is the read access is given on groupID basis and write access is given on user ID basis.
  Also, in the folder - it should only accept images with formats - png/jpeg/jpg/webp/gif</p>
  <p>However, while trying to test this via postman - I am able to add a ndjson file or .py file.
  For Example - The API call ends with - test.jpg but in the body - binary I am adding a .py file.
  Also, in the storage the .py is saved as type - image/jpg.</p>
  <p>This is being added to the storage.</p>
  <p>How can I restrict only image files be added from backend ?</p>