CODEWITHSUNDEEP
firebasefirebase-security
Hardik Sondagar
Hardik Sondagar

Reputation: 4495

Security rules in Firebase

I've database structure like

 appointments
     [$userId]
         [$appointmentId]
              message:"something"
              date:"14/12/2015"
 users
    [$userId]
        name: Hardik
        email: [email protected]

And I'm using angularfire library of Firebase, I'm trying to restrict read operation based on uid ( means a person who created appointment only can read that). I've tried following security rule 

{
  "rules": {
    "appointments": {
      "$userId":{
        "$appointmentId":{
         ".read": "auth.uid==$userId",
         ".write": true
        }
      }
    },
    "users": {
      "$userId":
        {
          ".read": "auth!=null && $userId === auth.uid",
          ".write": "auth!=null && $userId === auth.uid"
        }
    }
  }

But end up on this error Error: permission_denied: Client doesn't have permission to access the desired data.

I'm trying to access all the user's appointments using following code

 var ref = new Firebase("https://<FIREBASE-APP>.firebaseio.com/appointments/"+uid);
 $scope.appointments = $firebaseArray(ref);

Upvotes: 1

Views: 519

Answers (1)

David East
David East

Reputation: 32604

Set rules for the $uid wildcard, to read all the children.

"appointments": {
  "$uid":{
    ".read": "auth.uid == $uid",
    ".write": "auth.uid == $uid",
  }
}

The $uid wildcard sets permissions for the entire list, whereas the $appointmentId wildcard sets permissions for each individual item.

But Security Rules cascade, so you only need to set the rules for the top level.

Read the docs on cascading for more information.

Upvotes: 2

Related Questions