Access denied on Firebase Realtime Database security rules simulator

Question

It is hard for me to understand why the simulator puts me off for this input

I supplied this auth token body:

{
  "account": "7xms2zm6noz03f2mvn",
  "playerId": "d3221a31-263c-4629-92fb-6cac89b67088"
}

I am using custom authentication to supply the above blob.

Please see the attached screenshot for how the simulator treats this:

This is my database tree:

What am I missing?

robsiemb robsiemb · Accepted Answer · 2019-11-21T20:08:18

It appears that when you use the simulator, the "auth token payload" is actually at the auth level, not at the auth.token level.

So, you need to simulate the auth.token.account claim like this:

{
  "token": {
    "account": "7xms2zm6noz03f2mvn",
    "playerId": "d3221a31-263c-4629-92fb-6cac89b67088"
  }
}

You can tell it is (apparently) misnamed because if, for example, you select the "Google" provider, then provider and uid are both at the top level of this blob (which can't be modified), and that is where you would expect to find them.

Likewise this image from this blog post shows the token block as a sub-block in the simulator.

Access denied on Firebase Realtime Database security rules simulator

1 Answers