Rule of authentication using Firebase Database

Question

Rule of authentication using Firebase Database

I need to establish a rule in my Firebase Database to prevent unauthorized access for reading and writing purposes.
Within my database, there is a collection of words, each containing a "uid" field that corresponds with the uid of the authUser key stored in local Storage.

When making a REST call to Firebase, I include the uid parameter:

const urlByUser = 'orderBy="uid"&equalTo="'+uid+'"';

I have set up the following ".read" rule in my Firebase db, but it doesn't seem to be functioning correctly (I continually encounter unauthorized access even when passing the access token as a URL parameter):

{
  "rules": {
      "words": {
      ".indexOn": ["uid"],
      "$uid": {
        ".read": "$uid == auth.uid"
      }
    }
  }
}

Is there an issue within this rule?
Thank you.

typescript firebase firebase-realtime-database firebase-authentication firebase-security

Answer 1

Answer №1

When querying a location, the default requirement is that you must have read access to the entire location. This means that data cannot be filtered using rules.

A new feature allows you to write rules that control which queries are permitted in specific locations. For example, you can specify that reading from /words is only allowed if the query includes filtering by auth.uid. This way, you can create a rule that permits appropriately filtered queries and rejects unfiltered or incorrectly filtered listeners.

To learn more about this feature, refer to the Firebase documentation and the Firebase blog post on Introducing Query-based Security Rules. The code snippet below is adapted from those sources:

{
  "rules": {
     "words": {
        ".read": "auth.uid != null &&
                  query.orderByChild == 'uid' &&
                  query.equalTo == auth.uid"
     }
  }
}

Answer 2

When querying a location, the default requirement is that you must have read access to the entire location. This means that data cannot be filtered using rules.

A new feature allows you to write rules that control which queries are permitted in specific locations. For example, you can specify that reading from /words is only allowed if the query includes filtering by auth.uid. This way, you can create a rule that permits appropriately filtered queries and rejects unfiltered or incorrectly filtered listeners.

To learn more about this feature, refer to the Firebase documentation and the Firebase blog post on Introducing Query-based Security Rules. The code snippet below is adapted from those sources:

{
  "rules": {
     "words": {
        ".read": "auth.uid != null &&
                  query.orderByChild == 'uid' &&
                  query.equalTo == auth.uid"
     }
  }
}

Rule of authentication using Firebase Database

Answer №1

Similar questions

Route user based on login status using router

Steps for downloading a verified Google Storage URL on a client device

Customize the date format of the Datepicker in Angular by implementing a personalized pipe

What is the best way to showcase information in Angular?

Navigate to a different page using the A-g Grid router when a row is

TypeScript perplexed Babel with its unfamiliar syntax and could not compile it

TypeScript does not throw a compiler error for incorrect type usage

Issue found in the file assert.d.ts located in the node_modules directory: Expected '{' or ';' at line 3, character 68. Error code: TS1144

Angular class requires multiple class members and validators for MatSelection List to be bound with Formbuilder

The entry for "./standalone" in the "@firebase/database-compat" package does not have any documented conditions

The JavaScript code is executing before the SPFX Web Part has finished loading on the SharePoint page

Although everything appears to be running smoothly in Express, my request is returning null

Updating the main window in Angular after the closure of a popup window

Issues with Angular not reflecting data changes in the view after updates have occurred

Adding a constant to a Vue component

Leveraging TypeScript to sort and extract specific elements from two arrays

I don't understand why I'm receiving the error message "Unsafe assignment of an `any` value" when I clearly defined the value as a string with a default value

Create a global variable by importing an external module in TypeScript

ionChange - only detect changes made in the view and update the model in Ionic 2

Clearing error messages from a form using the reset button or after cancelling the form