Firebase Rule for auth.uid

Question

I use auth.uid to identify who owns a record.

eg. { "owner" : "facebook:100200" } is owned by user 100200 who authenticated using Facebook. Note: the uid is preceeded with the Provider name "facebook".

I have a rule that checks that only owners can read their own data.

Problem is, the Rule fails if :

  "owner" : "facebook:100200"  (has provider name)

It succeeds if :

  "owner" : "100200"    (no Provider name)

The Rule is :

   { ".read": "data.child('owner').val() == auth.uid" }

Is this correct behaviour ? If so, I should clip out the Provider details (ie."facebook") before I save the owner details. I am wondering if I am using the wrong auth.uid in the first place.

Here is how I get the auth.uid. It comes with the Provider name :

 // logged-in
 Auth.$onAuth(function(authData) {
  console.log("Logged in as", authData.uid);  // "facebook:100200"
 }

SOLVED When you test using the Firebase Simulator, take note of the JSON in the Custom Auth field. By default, the format is { provider: 'anonymous', uid: '100200' }. ie. uid was set to 100200

For the Rule to pass, I had to change the value in Custom Auth to { uid: 'facebook:100200' }

END

Many Thanks, Beemer

Solved it. I was testing in the Simulator via Custom-Authentication. The Custom Auth value should be set to { uid: 'facebook:100200' }. Do not use the format provided which is { provider: 'facebook', uid: '100200' } — Beemer
Ah, that indeed explains. Can you provide it as a self-answer and accept it? It might be useful for others who fall into this trap. — Frank van Puffelen
A self-answer is an answer that you enter in the box below your question. By marking it as accepted, the question is clearly identified as "Solved" and others won't have to read it to understand that they don't need to spend time on answering it anymore. — Frank van Puffelen

Beemer Beemer · Accepted Answer · 2016-02-06T04:59:12

Solved it. I was testing in the Simulator via Custom-Authentication. The Custom Auth value should be set to { uid: 'facebook:100200' }. Do not use the format provided which is { provider: 'facebook', uid: '100200' }

Firebase Rule for auth.uid

1 Answers