Develop Reference

Firebase Realtime Chat Rules

I made a chat application using firebase realtime database. Users can send private messages to each other. How should the rules part be? I keep getting emails from Firebase that the rules are not reliable.
This is my firebase Collections:
This is my firebase Rules:
{
"rules": {
".read": "auth.uid!=null",
".write": "auth.uid!=null",
}
}

Only an authenticated admin user can read and write their own admin-user data:
{
"rules": {
"admin-users": {
"$userId": {
".read" : "auth.uid === $userId",
".write": "auth.uid === $userId"
}
}
}
}
Or:
{
"rules": {
"admin-users": {
"$user": {
".read" : "data.child('userUid').val() === auth.uid",
".write": "data.child('userUid').val() === auth.uid"
}
}
}
}
An authenticated user can read all data under Users.
An authenticated user can can only update their own data except the 'userUid' field. Can only update the 'userUid' field if it is a new document creation ('!data.exists()') e.g when it is a signup/register.
An authenticated admin can read and write all the data in Users including the 'userUid' field.
{
"rules": {
"users": {
".read": "auth !== null",
"$userId": {
"userId": {
".write": "root.child('admin-users').child(auth.uid).exists() || !data.exists()"
},
"$other_fields": {
".write": "$userId === auth.uid || root.child('admin-users').child(auth.uid).exists()"
}
}
}
}}
Only Admins can read and write everything in under Chats
Authenticated users can read chat messages in which their userUid matches either 'senderId' or 'receiverId'
Authenticated users can write/update a message only if their userUid matches 'senderId'.
{
"rules": {
"chats": {
".read": "root.child('admin-users').hasChild(auth.uid)",
".write": "root.child('admin-users').hasChild(auth.uid)",
"$chat": {
"$message": {
".read": "auth !== null && data.child('receiverId').val() === auth.uid || data.child('senderId').val() === auth.uid",
".write": "auth !== null && !data.exists() || data.child('senderId').val() === auth.uid"
}
}
}
}}
These sample rules are just to give guidance on how security rules work. You can create different rules that can work as well with your use case. See link for more details https://firebase.google.com/docs/rules/insecure-rules
https://firebase.google.com/docs/database/security/core-syntax

Firebase Security Rules UserPhoneId

I created my app with the following database structure
Root/
Users/
+12345566777
+12345667765
+43223456677
And here it is an example of my security rules
{
"rules": {
"$uid": {
"Users": {
".read": "auth != null",
".write": "auth != null && auth.uid == $uid"
}
}
}
}
My problem is that instead of verifiying the auth.uid inside of my security rules i want to verify the (identifiant) the UserPhoneId is there any way to do that, thank you.

what rules database in firebase for user can read & right and admin can read database?

My firebase database rule is like the following:
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}

This rule will allow database read and write if user is authorized or logged in.
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}
This rule will allow database read and write without checking if the user is authorized.
{
"rules": {
".read": "true",
".write": "true"
}
}

auth.uid is not working

Rule:
{
"rules": {
"userdata":{
"$id":{
".read": "(auth.uid=='aI2OGxb2pnY58ix5ugZLv0rhZqn2')",
".write": "(auth.uid=='aI2OGxb2pnY58ix5ugZLv0rhZqn2')"
}
}
}
}
Actually my rule is so different. But to confirm that auth.uid is not working for me. I added this into my rules and I got same result (Permission Denied).
And my original uid is also same as given in the above rules.
So are there anything wrong in the rule structure or I'm doing anything wrong in firebase configuaration.
Thanx

Don't forget to set read and write rules to false.
{
"rules": {
".read": "auth != false",
".write": "auth != false",
"userdata":{
"$id":{
".read": "auth.uid == $id",
".write": "auth.uid == $id",
}
}
}
}
Hope it helps.

Or operator '||' not working in firebase rules

I'm trying to change my firebase realtime database rules so that I can access it from both authenticated and unauthenticated users, I changed them to
{
"rules": {
".read": "auth == null",
".write": "auth != null" ||"auth==null"
}
}
But the or operator || is not working. What should I do?
Thanks!

Try This
{
"rules:{
".read": "auth == null",
".write": "auth != null || auth==null"
}
}

Also, If you want to allow both users authenticated and non-authenticated , it means you want to allow all users to access database, then you can do this :
These rules give anyone, even people who are not users of your app,
read and write access to your database
{
"rules": {
".read": true,
".write": true
}
}