Firebase Database Rules

2 min. read

Firebase Database Security Rules

The Firebase Database has a rules language, called the Security Rules.

Rule Types

.read
.write
.validate
.indexOn

Read Rule

Write Rule

Validate Rule

If validation fails, data is not saved.

Example:

{
  "rules": {
       "users":{
“$uid”:{
	“.validate”: “newData.child(‘firstName’).isString() &&
			newData.child(‘dob’).isNumber()”
}
      },
  }
}

IndexOn Rule

Default Rules

{
“rules”: {
“.read”: “auth != null”,
“.write”: “auth != null”,
“users”:{
“.indexOn”: “email”
},
“accounts”:{
“.indexOn”: “email”
}
}
}

{
“rules”: {
“.read”: “auth != null && root.child(‘users/‘ + auth.uid + ‘/roles/admin’).val() == true”,
“.write”: “auth != null && root.child(‘users/‘ + auth.uid + ‘/roles/admin’).val() == true”,

"categories": { ".read": true } ,
"tagList": { ".read": true } ,
"users": {
  "$uid": {
   ".read": "auth != null && $uid == auth.uid",
    "roles": { ".write": false },
    "questions": { ".write": "auth != null && $uid == auth.uid" }
  }
},
"questions": {
  "published": { ".read": true },

“unpublished”: {
“$question_id”: {
“.read”: “auth != null && data.child(‘created_uid’).val() == auth.uid”,
“.validate”: “newData.child(‘created_uid’).val() === auth.uid”,
“.write”: “auth != null && ((data.exists() &&
data.child(‘created_uid’).val() == auth.uid &&
data.child(‘status’).val() != 2)
||
(!data.exists() &&
newData.child(‘created_uid’).val() == auth.uid))”
}
}
}
}
}

Pagination
https://howtofirebase.com/collection-queries-with-firebase-b95a0193745d