Firebase realtime phone database security rules

Question

I need some help with securing my database.

My database looks like this (i'm using phone numbers instead of uid):

database

As you can see under the Users node there are the phone numbers of the authenticated users. My goal is to secure the database so the Users would be able to read and write their own data.

I've tried this code to give access to each user to read and write his own data:

{
  "rules": {
        "Users":{
      "$user":{
        ".read": "auth.token.phone_number===$user",
        ".write": "auth.token.phone_number===$user"
    }
    
    
      }
  }
}

But whenever I try this on the rules playground or on my app I get simulated read denied:

Security rules

Can you guys help me resolve it?

Omer Omer · Accepted Answer · 2020-11-01T11:01:08

Ok guys after days of searching for answer I got to a conclusion that it's better to edit my database stracture and use the uid's instead of the phone numbers, because that's how firebase is designed for his users.

Firebase realtime phone database security rules

1 Answers