CODEWITHSUNDEEP
javascriptfirebasefirebase-realtime-databasefirebase-security
Robert Prine
Robert Prine

Reputation: 2753

Firebase Permission Denied

I'm relatively new to coding and am having trouble.

I have this code to send data to firebase

app.userid = app.user.uid

var userRef = app.dataInfo.child(app.users);

var useridRef = userRef.child(app.userid);

useridRef.set({
  locations: "",
  theme: "",
  colorScheme: "",
  food: ""
});

However, I keep getting the error:

FIREBASE WARNING: set at /users/(GoogleID) failed: permission_denied 2016-05-23 22:52:42.707 firebase.js:227 Uncaught (in promise) Error: PERMISSION_DENIED: Permission denied(…)

When I try to look this up it talks about rules for Firebase, which seems to be in a language that I haven't learned yet (or it is just going over my head). Can someone explain what is causing the issue? I thought it was that I was asking for it to store email and user display name and you just weren't allowed to do this, but when I took those out I still had the same problem. Is there a way to avoid this error without setting the rules, or are rules something I can teach myself how to write in a day, or am I just way out of my league?

Thanks for any help!

Upvotes: 156

Views: 248205

Answers (11)

Lakshmipriya Ramesh
Lakshmipriya Ramesh

Reputation: 36

I was also facing a similar issue in my next app. I declared my config as,

const firebaseConfig: FirebaseOptions = {
  apiKey: process.env.FIREBASE_API_KEY,
  authDomain: process.env.AUTH_DOMAIN,
  projectId: process.env.PROJECT_ID,
  storageBucket: process.env.STORAGE_BUCKET,
  messagingSenderId: process.env.MESSIGING_SENSOR_ID,
  appId: process.env.APP_ID,
};

The problem is that process.env is provided by the node.js runtime; however, it is NOT available in the browser. So when you run the application values like process.env.PROJECT_ID evaluate to undefined. That's why you see the error "Consumer 'project:undefined' has been suspended."

Solution: You can prefix the variables using NEXT_PUBLIC_ to expose them on the browser.

const firebaseConfig = {
  apiKey: process.env.NEXT_PUBLIC_API_KEY,
  authDomain: process.env.NEXT_PUBLIC_AUTH_DOMAIN,
  projectId: process.env.NEXT_PUBLIC_PROJECT_ID,
  storageBucket: process.env.NEXT_PUBLIC_STORAGE_BUCKET,
  messagingSenderId: process.env.NEXT_PUBLIC_MESSAGING_SENDER_ID,
  appId: process.env.NEXT_PUBLIC_APP_ID,
};

Upvotes: 0

just-be-weird
just-be-weird

Reputation: 1310

I was facing similar issue and found out that this error was due to incorrect rules set for read/write operations for real time database. By default google firebase nowadays loads cloud store not real time database. We need to switch to real time and apply the correct rules.

enter image description here

As we can see it says cloud Firestore not real time database, once switched to correct database apply below rules:

{
   "rules": {
       ".read": true,
       ".write": true
     }
 }

Note:

Be careful with the rules. By setting read and write to true makes database vulnerable to praying eyes.

Read more:

https://firebase.google.com/docs/database/security

Upvotes: 92

Stycs07
Stycs07

Reputation: 25

i was also having the same problem. make sure that you are using the real-time database instead of the cloud. then change rules to allow access to all users as follows

{
  "rules": {
    ".read": true,
    ".write": true
  }
}

by default the firestore database only allows admins to read and write from the database thus the read/write rules will be set to false.

Upvotes: -2

Voy
Voy

Reputation: 6274

PermissionDenied can also appear if provided Firebase project ID is incorrect.

See this guide to check your project ID:

Firebase console: Click settings Project settings. The project ID is displayed in the top pane.

Upvotes: 2

Eduardo Pedra de Oliveira
Eduardo Pedra de Oliveira

Reputation: 77

If you are attempting to reuse an old project in firebase, due to free account restrictions, then your database rules are probably outdated.

In my case, I was getting error 401 Unauthorized and it solved when I set both read and write rules equal to true.

Thanks for this great community!

Much respect from Brazil!

Upvotes: 1

Frank van Puffelen
Frank van Puffelen

Reputation: 598668

By default the database in a project in the Firebase Console is only readable/writeable by administrative users (e.g. in Cloud Functions, or processes that use an Admin SDK). Users of the regular client-side SDKs can't access the database, unless you change the server-side security rules.

You can change the rules so that the database is only readable/writeable by authenticated users:

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

See the quickstart for the Firebase Database security rules.

But since you're not signing the user in from your code, the database denies you access to the data. To solve that you will either need to allow unauthenticated access to your database, or sign in the user before accessing the database.

Allow unauthenticated access to your database

The simplest workaround for the moment (until the tutorial gets updated) is to go into the Database panel in the console for you project, select the Rules tab and replace the contents with these rules:

{
  "rules": {
    ".read": true,
    ".write": true
  }
}

This makes your new database readable and writeable by anyone who knows the database's URL. Be sure to secure your database again before you go into production, otherwise somebody is likely to start abusing it.

Sign in the user before accessing the database

For a (slightly) more time-consuming, but more secure, solution, call one of the signIn... methods of Firebase Authentication to ensure the user is signed in before accessing the database. The simplest way to do this is using anonymous authentication:

firebase.auth().signInAnonymously().catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  // ...
});

And then attach your listeners when the sign-in is detected

firebase.auth().onAuthStateChanged(function(user) {
  if (user) {
    // User is signed in.
    var isAnonymous = user.isAnonymous;
    var uid = user.uid;
    var userRef = app.dataInfo.child(app.users);
    
    var useridRef = userRef.child(app.userid);
    
    useridRef.set({
      locations: "",
      theme: "",
      colorScheme: "",
      food: ""
    });

  } else {
    // User is signed out.
    // ...
  }
  // ...
});

Upvotes: 316

Jaywant Narwade
Jaywant Narwade

Reputation: 165

Go to database, next to title there are 2 options:

Cloud Firestore, Realtime database

Select Realtime database and go to rules

Change rules to true.

Upvotes: 10

Anindya Sankar Dasgupta
Anindya Sankar Dasgupta

Reputation: 37

  1. Open firebase, select database on the left hand side.
  2. Now on the right hand side, select [Realtime database] from the drown and change the rules to:
{
  "rules": {
    ".read": true,
    ".write": true
  }
}

Upvotes: 4

Ahmed Adewale
Ahmed Adewale

Reputation: 3123

Go to the "Database" option you mentioned.

  1. There on the Blue Header you'll find a dropdown which says Cloud Firestore Beta
  2. Change it to "Realtime database"
  3. Go to Rules and set .write .read both to true

Copied from here.

Upvotes: 45

Ondřej Bauer
Ondřej Bauer

Reputation: 91

OK, but you don`t want to open the whole realtime database! You need something like this.

{
  /* Visit https://firebase.google.com/docs/database/security to learn more about security rules. */
  "rules": {
    ".read": "auth.uid !=null",
    ".write": "auth.uid !=null"
  }
}

or 

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Upvotes: 4

Parampal Pooni
Parampal Pooni

Reputation: 3108

Another solution is to actually create or login the user automatically if you already have the credentials handy. Here is how I do it using Plain JS.

function loginToFirebase(callback)
{
    let email = '[email protected]';
    let password = 'xxxxxxxxxxxxxx';
    let config =
    {
        apiKey: "xxx",
        authDomain: "xxxxx.firebaseapp.com",
        projectId: "xxx-xxx",
        databaseURL: "https://xxx-xxx.firebaseio.com",
        storageBucket: "gs://xx-xx.appspot.com",
    };

    if (!firebase.apps.length)
    {
        firebase.initializeApp(config);
    }

    let database = firebase.database();
    let storage = firebase.storage();

    loginFirebaseUser(email, password, callback);
}

function loginFirebaseUser(email, password, callback)
{
    console.log('Logging in Firebase User');

    firebase.auth().signInWithEmailAndPassword(email, password)
        .then(function ()
        {
            if (callback)
            {
                callback();
            }
        })
        .catch(function(login_error)
        {
            let loginErrorCode = login_error.code;
            let loginErrorMessage = login_error.message;

            console.log(loginErrorCode);
            console.log(loginErrorMessage);

            if (loginErrorCode === 'auth/user-not-found')
            {
                createFirebaseUser(email, password, callback)
            }
        });
}

function createFirebaseUser(email, password, callback)
{
    console.log('Creating Firebase User');

    firebase.auth().createUserWithEmailAndPassword(email, password)
        .then(function ()
        {
            if (callback)
            {
                callback();
            }
        })
        .catch(function(create_error)
        {
            let createErrorCode = create_error.code;
            let createErrorMessage = create_error.message;

            console.log(createErrorCode);
            console.log(createErrorMessage);
        });
}

Upvotes: 1

Related Questions