Allow only read/write of one child - firebase

I've been messing around with my firebase database rules to try and allow users without authentication to only edit a certain child in my database, but I can't seem to figure it out.
Here is the database structure:
So I'm trying to allow users without authentication to edit the videoID, but not only that, I need the rule to ignore the room id (5555 in this example), meaning it only allows reading and editing of rooms/(roomid)/videoID
Thanks for all kinds of help!

The Firebase Database rules allow variables and can have different rules at different depths.
In your case, the below rules would allow any users (authenticated or not) to access /rooms/$roomid/videoID but only authenticated users to access the entire /rooms/ tree.
{
"rules": {
"rooms": {
".read": "auth != null",
".write": "auth != null",
"$roomid": {
"videoID": {
".read": "true",
".write": "true",
}
}
}
}
}
The Firebase rule simulator (accessible from the Rules tab of the Firebase Database console) is useful for testing rules before publishing:

Maybe something like this :
{
"rules": {
".read": true,
".write": "auth != null",
"rooms": {
"$roomId": {
"videoID": {
".write": true
}
}
}
}
}
It will allow user with authentification to edit another field beside videoID.
But if you want even authentificated user, also can only edit videoID, then the rule is :
{
"rules": {
".read": true,
".write": false,
"rooms": {
"$roomId": {
"videoID": {
".write": true
}
}
}
}
}
Remember, when the rule set true it will not traverse the child rule, But if it set false it will continue inspect the child rules.

Related

How can I give write permission to a specified user in Firebase?

I have a mobile application which reads the data from the firebase server without firebase login/authentication (posts and news) and I want to create an admin webpage where I can log in and add, or modify news, so I need a write permission there. My rules are currently:
{
"rules": {
".read": true,
".write": "auth !== null && ?????
}
}
Can I write something like "user.emailAddress == 'mail#example.com'"?
You can create a users table on database like
{
"users":{
"your UID":{
"isAdmin": true
}
}
}
Then edit rules :
{
"rules": {
".read": true,
".write": "auth.uid != null && root.child("users").child(auth.uid).isAdmin === true"
}
}
You might want to start by reading the documentation about securing user data. There is a lot to know here.
One possibility is using the known user's uid to restrict access. The auth.uid variable contains the uid.
".write": "auth.uid == 'the-known-uid'"
Also you can use auth.token to access some other things about the user, including email address (which may not be present):
".write": "auth.token.email == 'the#email.address'"
You can also use custom authentication tokens, which also is covered in the documentation.
Create database:
{
"users":{
"your UID":{
"isAdmin": true
}
}
}
Set rules:
Wrong:
{
"rules": {
".read": true,
".write": "auth.uid != null && root.child("users").child(auth.uid).isAdmin === true"
}
}
Right:
{
"rules": {
".read": true,
".write": "auth.uid != null && root.child('users').child(auth.uid).child('isAdmin').val() === true"
}
}

Firebase database rules for particular user

I have a db where I need read access to all users and
write access when invoked in an apps script running by the user =
'firebaseowner#gmail.com'
My firebase structure is
ABC/AAA1/date
ABC/AAA2/date
ABC/AAA3/date
ABC/AAA4/date
The rules are:
{
"rules": {
".read": true,
".write": false,
}
}
How do I make the rule to allow write when invoked by the user 'firebaseowner#gmail.com' in the apps script.
I use https://sites.google.com/site/scriptsexamples/new-connectors-to-google-services/firebase/reference for inserting data
You should check the auth variable.
To define the security rules that allow write access to all the locations by this email address firebaseowner#gmail.com only:
{
"rules": {
".read": true,
".write": "auth != null && auth.token.email == 'firebaseowner#gmail.com'"
}
}
To define the security rules that allow write access to only the location /users by this email address firebaseowner#gmail.com only:
{
"rules": {
".read": true,
"users": {
".write": "auth != null && auth.token.email == 'firebaseowner#gmail.com'"
}
}
}

firebase with auth and without auth security rules

I want to create a firebase rule where people can use the database without having to login. But I also want to make a private user node where only the user can acces it by authenticating so far I have something like this. But this trows an error
Error saving rules - Line 6: Expected '}'.
{
"rules": {
".read": true,
".write": "newData.exists()"
},
"test": {
"$uid": {
".read": "auth != null && auth.uid == $uid",
".write": "auth != null && auth.uid == $uid"
}
}
}
I do not understand why the above is not possible
But if I do only:
{
"rules": {
".read": true,
".write": "newData.exists()"
}
}
This wil work so that anyone can use the current data but I want to have something private like "Test" where the people who authenticated themself only have access to
So to be clear I want everyone to use the current database but I also want to have some private parts like test only accesable for registered users
Have a look at https://firebase.google.com/docs/database/security/securing-data
You cannot add an element after "rules". It should be like:
{
"rules": {
...
}
}
and not like
{
"rules": {
....
},
....
}

Can a security rule in Firebase allow write access for a specific user?

trying to get this to work :
{
"rules": {
".read": true,
".write": "auth.uid == simplelogin:2",
}
}
I want just a specific user to have a write control over everything (for now). How do I make this work?

Firebase security rules: Allow read on anything except one field

In my Firebase security rules, I want anonymous users to be able to read anything except one field (secret_field):
{
"rules": {
".read": true,
".write": "auth != null",
"stuff" : {
"$stuffID" : {
"secret_field" : {
".read" : "auth != null"
}
}
}
}
}
However, in Firebase, if any read rule on the way to secret_field evaluates as true, read access on secret field is granted.
Is there a way to reverse that behavior? (If any read rule on the way to secret_field evaluates to false, disallow read access)
You can't reverse the behavior, but you can solve this by introducing a "container" for the public fields and setting .read to true for it. For example:
{
"rules": {
"stuff" : {
"$stuffID" : {
"public" : {
".read": true
},
"secret_field" : {
".read" : "auth != null"
}
}
}
}
}
And then everything under .../public/ is accessible to everybody but .../secret_field is only accessible for authenticated users.

Resources