Fail to update Firebase security rules

Question

I have a database and got an email that my rules are not secure. this is what i have now:

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

i wanted to change it to something like in the example in the site, so a user can read\write only to his record, but this doesn't work. i get denied.

what am i doing wrong?

how do i know if my key is $uid or $user_id?

the database structure is like:

root
  --uid
    -- all the data

Rules:

{
  "rules": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }

  }
}

sample of my data:

sample of my data

Playground

Please edit your question to include the minimal, complete/standalone code that anyone of us can run to reproduce the problem. Without that code, it's hard to say why the rules don't work for you. — Frank van Puffelen
Hi Frank,the question refer only to the Firebase Rules Playground. not to my code itself. I added a sample of my data. please let me know if more information is needed. thanks — ori
In that case, please add a screenshot of the rules playground with all relevant information showing. Without seeing what doesn't work for you, it'll be hard to help. — Frank van Puffelen
these are the rules that I put in the original message. also attached an image — ori

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2020-06-02T14:10:21

These rules that you use in the playground screenshot:

{
  "rules": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }

  }
}

In these rules the $uid is a variable, meaning that the rules under that node apply to any top-level node. These rules then you allow the user to read/write their own data, when the path ($uid) matches their own UID.

But in the same playground screenshow you're trying to read /uid, in which case uid is just a hard-coded value. Since the auth.uid is not the actual UID of your user, the read/write is denied.

With the user that you've set up in the playground screenshot, you can read/write location /c252019c-c9c3-461e-bb79-e8a346862f08 (the UID of the user).

Fail to update Firebase security rules

1 Answers