How to securely implement rate limiting for authenticated users in Firebase Firestore? [duplicate]

Problem Context I'm building a Firebase iOS app application where authenticated users can access their own documents. Each user has a dedicated document in Firestore with security rules like:

match /users/{userId} {
  allow read: if request.auth != null && request.auth.uid == userId;
}

The issue: Users can potentially spam .get() calls on their own documents, leading to excessive read operations and unexpected billing costs.

Current Security Setup

✅ Firestore security rules restricting access via request.auth.uid

✅ Firebase App Check enabled for client verification

✅ Authentication required for all operations

Attempted Solution I tried implementing rate limiting by storing a lastAccessed timestamp in each user document:

match /users/{userId} {
  allow read: if request.auth != null 
    && request.auth.uid == userId 
    && request.time > resource.data.lastAccessed + duration.value(10, 's');
  
  allow update: if request.auth != null 
    && request.auth.uid == userId
    && request.resource.data.keys().hasOnly(['lastAccessed'])
    && request.resource.data.lastAccessed == request.time;
}

Problems with this approach:

1. I still require a cloud function to update the lastAccessed field . Malicious clients can skip the timestamp update
2. Architecture seems inefficient : using a cloud function to do a simple read

How to implement secure rate limiting for authenticated users in Firebase Firestore?

• I am just banking on the cache to protect me at this point