11

I’d like a security rule that lets anyone get a list of users and read their names, but only allows logged in users to view their own email.

Here’s an example data structure:

    "User" : {
        "abc123" : {
          "name" : "Bob",
          "email" : "[email protected]"
        }   
    }

A naive approach to a security rule might be to do the following:

"User" : {
    "$user" : {
        "name" : {
            ".read" : true
        },
        "email" : {
            ".read” : "auth.uid === $user"
        }
    }
}

However because there is no read rule at the User level, requests to read the list will be denied. But adding a read rule at the User level will override the email rule, and make every child node readable (see Rules Cascade in Firebase's Security Guide).

The Security guide does point out that Rules Are Not Filters, but doesn’t offer much guidance as to what to do about it.

Should I just split my User entity up into PrivateUser and PublicUser?

3

2 Answers 2

2

To let anyone get a list of users and read their names. AND to allow logged in users to view their own email.

Zac says: first think about access, and then to model objects that are either completely public or completely private.

Type 1:

{"rules":{
  "user_publicly":{"$user:{
    ".read":true,
    "name":{}
  }},
  "user_privately":{"$user:{
    ".read":"auth != null && $user == auth.uid",
    "email":{}
  }}
}}

Type 2:

{"rules":{
  "user":{"$user:{
    "public":{
        ".read":true,
        "name":{}
    },
    "private":{
        ".read":"auth != null && $user == auth.uid",
        "email":{}
    }
  }}
}}
1
  • I agree, especially when modelling with NoSQL rules, always try to make a private & public access in your structure, its possibly more efficient than having to make another duplicate set of data somewhere outside the Users node all over again Commented Jul 9, 2019 at 9:42
1

A "workaround" would be to use Firestore (has a lot of the good things from Firebase Realtime Database, but adds more querying options, etc).

There is no "rules are not filters" restriction in Firestore! EDIT: Thanks to @DougStevenson for making me be more specific. In Firestore, rules are still not filters, but they are compatible with filtering, unlike in Firebase Realtime DB.

Though, you have to construct your query in such a way, as to only return objects for which you have read permission (otherwise you get a security exception).

Here are some starting point docs:

Security rules: https://firebase.google.com/docs/firestore/reference/security/

Queries: https://firebase.google.com/docs/firestore/query-data/queries

2
  • This is not true. Security rules are still not filters in Firestore. The client has to filter based on the expectations of the rules. firebase.google.com/docs/firestore/security/… Commented May 18, 2020 at 15:59
  • @DougStevenson - true - they are not filters, but they are compatible with filtering. I'm adding an edit. Thanks.
    – KarolDepka
    Commented Jun 8, 2020 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.