0

So, I'm using AngularFire and Simple Login to create an app that has users, and each user has various properties. Everything on the front-end works fine - I am able to register a user, I can ng-repeat users, I can edit users' properties. However, the problem is that anyone logged in can edit everyone elses' properties too.

Now, I'm trying to figure out Firebase Security Rules.

Here's my data structure:

  {
    "users" : {
      "simplelogin:1" : {
        "color" : "yellow",
        "date" : 1426324169995,
        "email" : "[email protected]",
        "firstname" : "James",
        "image" : "http://telehealth.org/wp-content/images/user-placeholder.jpg",
        "projectDescription" : "Currently working on...",
        "upcoming" : "PTO / WFH / OOO",
        "yahoo" : "yahooIM"
      },
      "simplelogin:2" : {
        "color" : "orange",
        "date" : 1410328158691,
        "email" : "[email protected]",
        "firstname" : "Jane",
        "image" : "http://telehealth.org/wp-content/images/user-placeholder.jpg",
        "projectDescription" : "Currently working on...",
        "upcoming" : "PTO / WFH / OOO",
        "yahoo" : "yahooIM"
      }
    }
  }

And currently, here are my Firebase Security Rules:

{
  "rules": {
    "users": {
        ".read": true,
        ".write": true
    },
        "$uid": {
            "color": {
                ".read": true,
                ".write": "auth != null && auth.uid == $uid"
            }
        }
    }
}

In this example, what I'm trying to do is allow new users to be seen and created (which works), and also restrict only an authenticated user to edit his/her own properties. My question is: how do I fix my Firebase Security Rules so that a logged in user can only edit his or her own properties, such as $uid.color, $uid.projectDescription, and $uid.upcoming?

Any help or hint would be very appreciated!

Thank you!

1 Answer 1

2

What you have is almost correct.

  • You have $uid outside of the rules for users.
    • In that case, you're defining the rules for <your-firebase>.firebaseio.com/$uid, not <your-firebase>.firebaseio.com/users/$uid
    • Which means that /users has unrestricted read and write access, regardless of auth.
  • What you want to do is define the read/write rules for the user object in /users, which you can accomplish with something like this:
{
  "rules": {
    "users": {
      "$user_id": {
        // grants write access to the owner of this user account
        // whose uid must exactly match the key ($user_id)
        ".write": "$user_id === auth.uid"
      }
    }
  }
}

Source: https://www.firebase.com/docs/security/guide/user-security.html#section-variable

  • This would allow any user to be able to read a /users/$uid ref, but would only allow an auth with the specific $uid to write to it.
  • Also, you should note that the guide uses ===, not ==.

Resources

  • Check out the Security & Rules Guide
  • The User Based Security portion explains granting read/write access to specific users.
  • The Rules Cascade section of the "Securing Your Data" portion of the guide, the documentation says:

    Rules Cascade

    This is a critical concept of understanding Security and Firebase Rules. The child rules can only grant additional privileges to what parent nodes have already declared. They cannot revoke a read or write privilege.

    With the exception of .validate definitions, Security and Firebase Rules work from a top-down model. If a parent node grants read or write permissions, then it also grants access to all child nodes under it.

  • Revisiting the Chat Example shows the structuring of these rules in action.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.