Authentication Race Condition Causes New Users To Trip Security Rules - firebase

Question

Environment: Firebase Unity 6.6.0, Unity Editor 2019.2.8f1
I am seeing the error "This client does not have permission to perform this operation." for new Anonymous users who authenticated moments before. If I wait 5-30 seconds, and connect again with the same user, the issue does not appear.
My relevant Real Time Database security rules
{
"rules": {
"gameSettings":{
".read": true,
".write": false
},
"userCompletedMissions": {
".write": false,
"$uid": {
".read": "$uid === auth.uid",
}
},
"userRanks": {
".write": false,
".read": "auth != null",
"english": {
".indexOn": ["rankOrderKey", "dRankOrderKey", "wRankOrderKey", "mRankOrderKey"],
},
"spanish": {
".indexOn": ["rankOrderKey", "dRankOrderKey", "wRankOrderKey", "mRankOrderKey"],
}
}
}
}
My firebase project is a mobile game. First time players create an Anonymous FirebaseUser account with await auth.SignInAnonymouslyAsync();, and immediately listen for data. Anything that requires ".read": true works flawlessly, but anything with ".read": "auth != null" and ".read": "$uid === auth.uid" trips my Security Rules and throws the error "This client does not have permission to perform this operation."
For example: FirebaseDatabase.DefaultInstance.GetReference("userRanks/english/SOME_USER_ID").ValueChanged += SomeFunction(...);
It's clear that the User is authenticated but Firebase's Security Checker doesn't know yet. Is there a way for me to wait until I am actually Authenticated?
Edit: additional information
What I did find interesting was the logs from following these repro steps:
1. My Unity Game had an authenticated Firebase User "Semadikp6FheE1FZMqi7MnCy0Iv2" in the Unity Editor on my Mac OS Desktop
2. In the Firebase Console, I navigated to the Authentication Tab, found the user "Semadikp6FheE1FZMqi7MnCy0Iv2", and deleted the account.
3. The next time I started my Unity Editor, all of the "This client does not have permission to perform this operation" errors referenced the deleted user "Semadikp6FheE1FZMqi7MnCy0Iv2"
4. My Unity game tolerates runtime errors by reloading the game scene (Unity Editor Play Mode does not stop). When the scene reloaded, it initialized everything from scratch again including Firebase API calls. The Firebase User it referenced on this attempt was a new Firebase User "UTc2NqwgYPTUFnnDCGSTLQm0yv63". Everything worked smoothly.
These seems like a bug related to caching, either on the Unity Firebase client, or Firebase service.
Further explanation:
I was repeatedly deleting the Anonymous account connected to my Unity Editor device in an attempt to reproduce the bug preventing my team mate from running the game. Whenever he runs the game in Unity Editor, he gets hit with "This client does not have permission to perform this operation" errors that do not clear up on subsequent attempts. He has joined this project a couple weeks ago, and the project is 11 months old. It's very likely an innocent issue like a "file is missing" from the GIT checkout. Unfortunately, I haven't found any obvious mistakes on my part, and the problem remains unsolved. Please advise.

Answer 1

It doesn't sound like this is an issue based on the question, but the easiest suggestion I have is to make sure you have anonymous authentication enabled:
Next, you can check to see if the user is currently authenticated by checking:
FirebaseAuth.DefaultInstance.CurrentUser != null;
If you wanted, you could also check IsAnonymous on CurrentUser. I like to check this in a handler to the StateChanged listener for a global "the user has signed in" signal.
With all that said, since you're using await, you can always say:
FirebaseUser user = FirebaseAuth.DefaultInstance.SignInAnonymouslyAsync();
if (user != null) {}
or in a coroutine (my favorite when working with Unity):
Task<FirebaseUser> signInTask = FirebaseAuth.DefaultInstance.SignInAnonymouslyAsync();
yield return new WaitUntil(() => signInTask.IsComplete);
FirebaseUser user = signInTask.Result;
if (user != null) {}
Finally, I noticed that you're using Firebase 6.4.0 rather than 6.6.0 (the current latest). At some point there was an issue with FirebaseAuth.DefaultInstance going out of scope if you didn't hold onto it (that is, if the GC decided to run through after you let go of any reference to FirebaseAuth.DefaultInstance), calls to other Firebase products wouldn't have authentication information.
I would recommend updating to the latest SDK if you can, but also try to hold onto FirebaseAuth in a script marked as DontDestroyOnLoad. Kind of like this:
public class AuthHolder: MonoBehaviour {
public FirebaseAuth Auth {get; private set;}
void Start() {
Auth = FirebaseAuth.DefaultInstance;
DontDestroyOnLoad(gameObject); // should be at the root of a scene
}
void OnDestroy() {
Auth = null; // make sure it can get cleaned up when you exit the game
}
}
If this fixes your issue on the latest Firebase Unity SDK, open up an issue on the GitHub Issues page.
If you haven't seen it yet, I do cover Authentication and Unity in some detail in this video. Although it focuses on Email/Password rather than Anonymous authentication.
I hope that helps!
--Patrick