CODEWITHSUNDEEP
firebasefirebase-security
barsju
barsju

Reputation: 4446

How to allow users to write new content but not update/delete existing content

So I have this application where anonymous users are allowed to write but not read a specific path. They are posting data to a moderated message board kind of thing.

But with my current security rules, they are allowed to overwrite existing data as well. How can I disallow updates and allow only new posts.

My current security rules:

{
  "rules": {
     ".read": "auth != null",
     ".write": "auth != null",
    "inbox" : {
     ".write": true,
    },
    "moderated" : {
      ".read": true,
    },
  }
}

Upvotes: 4

Views: 1384

Answers (1)

Anant
Anant

Reputation: 7428

Use data.exists() to determine if the object they're trying to write already exists:

{
  "rules": {
     ".read": "auth != null",
     ".write": "auth != null",
     "inbox" : {
       "$post" : {
          ".write": "!data.exists()",
       }
     },
     "moderated" : {
       ".read": true,
     },
  }
}

Upvotes: 6

Related Questions