CODEWITHSUNDEEP
firebasefirebase-securityfirebase-authentication
AngularM
AngularM

Reputation: 16618

Firebase - In security rules how do I restrict a user to only update an object that they originally created?

Firebase - In security rules how do I restrict a user to only update an object that they originally created.

So they cannot update another persons object?

Current security rules:

{
  "rules": {

    "organisations": {
        "$uid": {
           ".read": "$uid === auth.uid",
           ".write": "$uid === auth.uid"        
        }
    }

  }
}

This prevents the user doing anything.

This is the firebase organisations table:

enter image description here

Upvotes: 1

Views: 249

Answers (1)

David East
David East

Reputation: 32604

You can check on the auth.uid variable and the newData variable.

{
  "rules": {
    "organisations": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid",
        ".validate": "newData.hasChildren(['uid'])
      }
    }
  }
}

This means that your data must have a uid property.

Check out the Firebase Security Guide for more information.

Also, you may want to check out the Bolt compiler.

Upvotes: 2

Related Questions