CODEWITHSUNDEEP
firebasefirebase-realtime-databasefirebase-security
Hesam
Hesam

Reputation: 53600

How to grant write access to only a person within Rules?

I am little bit confused about setting permissions in Rules section of my Firebase database.

I am working on an app (which is a Book actually) and the app must be updated by only one person with this email address: [email protected]. Therefore the rest of people, either authenticated or not, must not be able to modify the contents, but they are allowed to read.

Upvotes: 0

Views: 80

Answers (1)

cartant
cartant

Reputation: 58400

If you look at the Firebase Security Rules API, you'll see that the user's email address (if there is one) is made available via auth.token.email.

So to grant write access to the entire database to the user with the [email protected] email address and read access to everyone else, you could define rules like this:

{
    "rules": {
        ".read": true,
        ".write": "auth !== null && auth.token.email === '[email protected]'"
    }
}

Said rules would grant read access to everyone. If you wanted to grant read access only to authenticated users, you could use:

{
    "rules": {
        ".read": "auth !== null",
        ".write": "auth !== null && auth.token.email === '[email protected]'"
    }
}

Upvotes: 1

Related Questions