CODEWITHSUNDEEP
javascriptfirebasefirebase-realtime-databasefirebase-security
anadar
anadar

Reputation: 5

firebase rules for children but not parent

I am using Firebase and want to allow writing on a child but not on parent.

I have a collection that is called guests. Users can set data to it using their userId by writing data to: guests/userId I want to prevent a user to write data on guests: /guests.

These are my rules:

{
  "rules": {
    ".read": false,
    ".write": false,
    "guests": {
       ".write": "newData.exists()",
    }
  }
}

With the rules above, user can run both commands:

guests.child(userId).set(profileData);
guests.set(profileData);

I want to make a rule that prevent him to run the second line: guests.set(profileData);

Upvotes: 0

Views: 273

Answers (1)

Raphael St
Raphael St

Reputation: 671

You can use a WildCard for user id:

"rules": {
  ".read": false,
  ".write": false,
  "guests": {
    ".read": false,
    ".write": false,
    "$user_id": {
      ".write": "newData.exists()",
    }
  }
}

Upvotes: 1

Related Questions