CODEWITHSUNDEEP
firebasefirebase-realtime-databasefirebase-securityfirebase-console
Groovdafied
Groovdafied

Reputation: 45

Firebase User Security Simulation

I'm really scratching my head here, and I've been reading as much as I can on many other cases. I'm new to Firebase, but got some understanding of it. I was wanting to restrict certain records of the database to certain users. So here's my JSON:

  "accounts" : {
    "13asdf313" : {
      "dog" : "bacon",
      "email" : "[email protected]",
      "first" : "luis",
      "last" : "xxxx"
    },
    "HlELrrGDbiMKgxxxx" : {
      "name" : "Luis"
    },
    "anthony" : {
      "email" : "[email protected]",
      "last" : "xxxx",
      "name" : "anthony"
    },
    "jpSq6UzX0mcAvExxxx" : {
      "name" : "anthony"
    }
  }

Here are the rules set up based on what I've been reading:

{
  "rules": {
    "accounts":{

      "$uid":{
        ".read": "auth.uid == $uid",
        ".write": "auth.uid == $uid"
      }
    },

  }


}

In the simulator, I used the bottom condition (I even put /accounts in the location field). I used the UID: HlELrrGDbiMKgxxxx, copied straight from Firebase account list.

enter image description here

This is always coming up as failed

enter image description here

What am I doing wrong?

Upvotes: 1

Views: 71

Answers (1)

creativecreatorormaybenot
creativecreatorormaybenot

Reputation: 126854

You have to insert accounts/HlELrrGDbiMKgxxxx into the Location field.

Otherwise you are trying to access the whole database (standard location is root, which covers the whole database). Your rule is just set for the child accounts/$uid and to access it the user id from authentication and the child location in the database must match.

Upvotes: 2

Related Questions