How to write Realtime Database basic rules for user based security?

Question

I'm trying to implement user-based security in my Firebase Realtime DB.

As a basic example, I want authenticated users to be able to read/write their own data from the "users" node.

I've tested this in the Realtime DB rules simulator and I'm getting a failed read with the following parameters:

Location: /users
Authenticated: true
Provider: Anonymous
UID: "aLoBLejDJ5P4PDZkZhe2LTxO8x32" (tried with and without quotation marks)

I got "Simulated read denied" (no explanation why though). The same happens when I try a read through a REST HTTP GET request ("Error: Permission denied").

This is my db structure:

{
  "users" : {
    "-LrAxMc5SANNe-p1Fd6n" : {
      "test" : "lol",
      "uid" : "aLoBLejDJ5P4PDZkZhe2LTxO8x32"
    }
  }
}

And these are the rules so far

{
  "rules": {
    "users" : {
      ".indexOn": "date",

      "$uid": {
        ".read" : "$uid === auth.uid",
        ".write" : "$uid === auth.uid",
      }
    }
  }
}

The expected result was to get THAT user's data in the HTTP response, instead I got the above permission errors.

Being fairly new to Firebase, I don't know what the problem is, if I'm understanding/implementing the rule syntax wrong or something else.

Also the uid I receveid in the HTTP response from sign up (above) looks a lot different compared to sample uid's I've seen in the Firebase docs, don't know if that's part of the issue?

The only login method in my application is currently email + password.

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2019-10-15T13:41:37

From the way you've phrased your question it seems that you think that security rules would automatically filter the data. That is not true: security rules only ensures that the user has permission to read the data they're trying to read. This happens when you attach the listener, and is not in any way based on the actual data in your database.

For more on this, see the section rules are not filters in the documentation, some of the many previous questions on the topic, and the documentation on securely querying.

You're trying to read /users. Since nobody has read permission on that node in our rules, the database rejects the read operation.

To read the data for the current user with your current rules, read from the entire path to that user's data:

/users/aLoBLejDJ5P4PDZkZhe2LTxO8x32

To allow reading from the /users node, you can modify your rules to:

{
  "rules": {
    "users" : {
      ".indexOn": "date",
      ".read": "auth.uid != null",
      "$uid": {
        ".write" : "$uid === auth.uid",
      }
    }
  }
}

But this would allow anyone to read all user data.

How to write Realtime Database basic rules for user based security?

1 Answers