CODEWITHSUNDEEP
javascriptfirebasefirebase-realtime-databasefirebase-security
modusTollens
modusTollens

Reputation: 417

Firebase database security for new users

Is there a way to check the values using rules that are initially set on user creation?

I have perused the firebase docs to no avail.

When the function createUserWithEmailAndPassword is called, I then create some values in the database, for example:

    "users": {
        "ht35resf435dwe3rfdw": {
            "is_premium": false,
            "display_name" "John",
            "last_login": 15353723826
        }
    }

The problem I am facing is: is_premium: false is part of the front end code and I am worried that a user could somehow change this to is_premium: true.

I can't figure out a way to check that it is initially set to false on creation.

P.s I could be going about this all wrong, I am a junior so I would appreciate any and all pointers.

Upvotes: 0

Views: 53

Answers (3)

Remington Holder
Remington Holder

Reputation: 41

I just started using Firebase so I cannot provide much information. If you want to start learning it there is a great series you can watch. Also, I would suggest using Cloud Firestore instead of the Realtime Database because the ladder is older and has fewer features. Changing the security rules on your database will let you fiddle with which users can edit data. What you need to do is make the premium default to false or even not exist in the database and then create a javascript function to create or change it to true in the database.

EDIT:

Ajith Naruto's would work but it would also disallow all writing to the database from the web app.

EDIT 2:

Frank van Puffelen's should work I would go off of his answer.

Upvotes: 0

Frank van Puffelen
Frank van Puffelen

Reputation: 599976

To only allow a value to be set to false, you can use a validation rule:

{
  "rules": {
    "users": {
      "$uid": {
        "is_premium": {
          ".validate": "newData.isBoolean() && newData.val() == false"
        }
      }
    }
  }
}

The above will simply only allow false to be written by any client. When you're writing using an Admin SDK however, those writes bypass these security rules. So you can use the Admin SDK to mark premium users.

Upvotes: 2

Ajith Naruto
Ajith Naruto

Reputation: 21

you can just change the security rules as below so that the user won't be able to make changes.

{
  "rules": {
    "foo": {
      ".read": true,
      ".write": false
    }
  }
}

Upvotes: 0

Related Questions