CODEWITHSUNDEEP
firebasefirebase-security
Doanh Do
Doanh Do

Reputation: 1

Can a Firebase Security Rule check if someone has specific access rights?

Can I use the keyword "in" to check if a user's authentication matches a Firebase security rule?

For example, I create a user token with:

var token = tokenGenerator.createToken({ "uid": "1234", "access": [file1, file2, file3] });

I want to check if the user can access a particular file by setting the following security rule:

{
   "rules": {
       ".read": true,
       ".write": "file3 in auth.access"
    }
}

I am not sure if this works or is there a similar pattern for Firebase security. I want to issue each user unique security tokens that allows them to access certain files.

Upvotes: 0

Views: 1243

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598847

What you're describing is a form of role-based security, which you can definitely build on Firebase.

This requires that you store the roles in your Firebase (and not just dynamically add them to the token):

users
    twitter:214
        files
            file1: true
            file2: true
    twitter:469
        files
            file2: true

Your rule would then be:

".write": "root.child('users/'+auth.uid+'/files/file1').exists()"

Upvotes: 6

Related Questions