CODEWITHSUNDEEP
iosfirebasefirebase-realtime-databasefirebase-security
Alexander Khitev
Alexander Khitev

Reputation: 6841

How do I prevent access to changes after creating a node in Firebase Database?

I have the following case, how can I deny access to update (overwrite) the node if it already exists? For example, the request for additions to friends, I want that, this feature was executed once because it set rules in the database, but they do not work. How can this be fixed?

Rules

// friends 
      "friends": {
        "$ownerID": {
          "friendIncomingRequests": {
            "$secondUserID": {
              ".write": "!data.exists()" // Only allow new nominations to be created
            }
          },
          "friendOutgoingRequests": {
             "$secondUserID": {
              ".write": "!data.exists()" // Only allow new nominations to be created
            }
          }
        }
      }

Data

  "friends" : {
    "8OdvaGQfMVdJrlCxdc5pOaj09hy2" : {
      "friendOutgoingRequests" : {
        "mp9pfsfVQKavwYddjYYPC5Ja9N93" : {
          "timeStamp" : 1.495514876872129E9,
          "userID" : "mp9pfsfVQKavwYddjYYPC5Ja9N93",
          "userName" : "Tim C."
        }
      }
    },
    "mp9pfsfVQKavwYddjYYPC5Ja9N93" : {
      "friendIncomingRequests" : {
        "8OdvaGQfMVdJrlCxdc5pOaj09hy2" : {
          "senderID" : "8OdvaGQfMVdJrlCxdc5pOaj09hy2",
          "senderName" : "Alexsander K.",
          "timeStamp" : 1.495514876872129E9
        }
      }
    }
  },

Update I think the problem is in this code, since I have this code also in the rules. But how can I fix it?

"rules": {
    ".read": "auth != null",
    ".write": "auth != null",
 }

Update 1: Here are all the rules. I need to make a specific write rule (updates) only in friends. I saw examples that for each individual branch of their rules, but if I need to do some specific rules for one branch, and for the rest of the database you need standard rules how should I do this better?

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null",



      // card location
    "cardLocation": {
      // Allow anyone to read the GeoFire index
      //".read": true,
      // Index each location's geohash for faster querying
         ".indexOn": "g",

     },

      "cards": {
        ".indexOn": "ownerID"
      },

      "userListEvents": {
          "$uid": {
            ".indexOn": "isConfirmed"
          }
      },

      "userImages": {
        "$uid": {
          "userProfileImages": {
                            ".indexOn": "isoDate"
          }
        }
      },

      // tags 
      "userTags": {
        "$uid": {
          ".indexOn": "isSelected"
        }
      },


        // people search
        // 
        "userLocations": {
          ".indexOn": "g"
        },


      // friends 
      "friends": {
        "$ownerID": {
          "friendIncomingRequests": {
            "$secondUserID": {
              ".write": "!data.exists()" 
            }
          },
          "friendOutgoingRequests": {
             "$secondUserID": {
              ".write": "!data.exists()" 
            }
          }
        }
      }

  }
}

Upvotes: 0

Views: 71

Answers (1)

Tony Nguyen
Tony Nguyen

Reputation: 491

I think the problem is in this code, since I have this code also in the rules. But how can I fix it?

"rules": {
    ".read": "auth != null",
    ".write": "auth != null",
 }

Yes, your thought is correct. Firebase .read and .write rules cascade. So you should put every .read and .write on each child node of your data structure. Something like that:

{
  "rules": {
  //skip this
    "someNode": {
        ".read": "auth != null",
        ".write": "auth != null"
    },
    // friends 
    "friends": {
      "$ownerID": {
        "friendIncomingRequests": {
          "$secondUserID": {
           ".write": "!data.exists()" 
        }
      },
        "friendOutgoingRequests": {
          "$secondUserID": {
            ".write": "!data.exists()" 
          }
        }
      }
    }
    //...
  }
}

Upvotes: 1

Related Questions