Develop Reference

Having trouble with firebase rules

I'm new to firebase and I want to do some rules and I don't know how to do it well. If someone can help me and explain to me how they work. That would be nice! So let's start!
This is my realtime database: Image of Database
And what I want to do is that only registered users in the app can read messages and user information. Also only that you cannot delete/edit a message if you aren't the user that sent the message. The same for user information if you aren't the user you can't modify anything only read. Sorry for my English.
How can I do that? With Firebase Rules.
My actual rules are:
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}
I've tried with internet examples and StackOverflow examples but I couldn't have it done. So I left it like this.

So,
First: In rules you have three standard parameters: "read","write" and "validate". You can build you rules to suit you database schema. Let`s do it:
{
"rules":{
"Messages":{
// we will ad rules here leter
},
"Users":{
// we will ad rules here leter
},
".write":false,
".read":false
}
}
Now we can set diffrent rules for "Message" node, and different for "Users" node. Last parameters are for root, we dont want user to set new node or read them, we want only to allow them read/write in upper two nodes.
When user will be trying to read from Message nodes, rules will check "Root/Message" and look for rules there, rules in "Users" block wont affect this operation.
Rules working cascade, this mean that if user find ruleswhich allow him to write, write operactions will be accepted by database, even if lower will be rules with forbit this.
In firebase rules you can use plenty of functions. First let`s protect "Users" node.
to allow write only for authenticate user we will add something like this:
"Users":{
$uid:{
".write": auith.uid == $uid,
".read": auth != null,
},
".write": auth != null
}
With $ sign we can create variable, when users try to write/read in Root/Users/1234, $uid will take value 1234. With "auith.uid == $uid" we only allow user to write in their own nodes
. We should also set write rules lower (in "Users" node) to allow users to add new child to this node.
For "Message" rules we will use hasChild() method, something like this:
"Message":{
$messageUID:{
".write": data.child('uId').val() == auth.uid,
".validate": newData.hasChild('message') && newData.hasChild('name')..
},
".write":root.child("Users").haschild(auth.uid),
".read":root.child("Users").haschild(auth.uid)
}
Here we`re setting that only user whose uid is in uId property can write in $messageUID node. ".validate" rules are checking if data after operations will having message child and name child (you can add more child ).
Rule ".write":root.child("Users").haschild(auth.uid) will only allow to write for user whose id exist in Users node.
All together we have:
{
"rules":{
"Messages":{
"$messageUID":{
".write": "data.child('uId').val() == auth.uid",
".validate": "newData.hasChild('message') &&
newData.hasChild('name')"
},
".write": "root.child('Users').hasChild(auth.uid)",
".read":"root.child('Users').hasChild(auth.uid)",
},
"Users":{
"$uid":{
".write": "auth.uid == $uid",
".read": "auth != null",
},
".write": "auth != null"
},
".write":false,
".read":false
}
}
I wasn't tested this rules so maybe you need to change something, but now you should better understand how to use rules and what you can do with them. Ask if something will be wrong

Firebase security rules allows authenticated users to add but never modify

I have just added security rules to my Firebase project such that reading is public and writing is only permitted for authenticated users. This is the rules' json on Firebase:
{
"rules": {
"Country" :{
".read": "true",
".write": "auth !== null",
}
}
}
There is no problem with reading at all. Writing, however, cannot be done unless a new parent is added; I use db.push() and it works greatly. Whenever some modification on data that already exists is done I get "Permission denied" in the logcat.
I have tried to do the following but it still doesn't work:
{
"rules": {
"Country" :{
".read": "true",
".write": "auth !== null && (data.exists() || !data.exists())",
}
}
}
How might this issue be solved? it will be really tiresome to delete every data the user needs to modify and re-pushing it since the application is really huge.

Firebase Android Banning Users

I have an android app that people can write something on chatbox.
They login with google account. And i have their user id which is shown below by $uid
But if there will somebody writing stupid things i want to prevent this person's writing ability.
So how can i make this by using this body. Or what is your suggestion?
{
"rules": {
"users": {
"$uid": {
".read": "$uid === auth.uid",
".write": "$uid === auth.uid"
}
}
}
}
source: https://firebase.google.com/docs/database/security/

Updated Answer
First, you have to change your banned user JSON model to follow format.
Path pattern
/banned-users/$userid: true
From above image
/banned-users/fasjdkflksdflad: true
now change your rules to the following way
{
"rules": {
"messages": {
"$messageId": {
".read": "auth.uid != null",
".write": "auth.uid != null && !root.child('/banned-users/'+auth.uid).exists()"
}
},
}
}
Say you are adding messages to the /messages path with each messages id as $messagesId then your /messages path looks like below
{
"messages": {
"-KTKvywjwDv4RpYjQglu":{
"text": "Hey Guys..."
},
"-KTKvywjwDv4RpYjQglu":{
"text": "How you doing ..."
}
}
}
Explanation
According to the rules, any logged in user can read the /messages ".read": "auth.uid != null", defines that.
To write to message to /messages path, then firebase check for if the (user is logged in AND /banned-users/user-id path exists) in firebase. As auth.uid is internal firebase variable used when rule validation. ".write": "auth.uid != null && !root.child('/banned-users/'+auth.uid).exists()" defines that.
you can ignore .validate you can achieve this by just using .write.
old answer
You cannot do it with just security rules.
First, you have to use Firebase cloud functions.
Create database trigger on the /chats database path. When the new message contains stupid things then you can delete it right away and you can get the user ID and save it to some other path say /banned-users/<userid>
Now you can write the .validate rule to check current messaging userid is not on the banned list. Using
".validate": "!root.child('/banned-users/'+$uid).exists()"
If you have to completely disable user account then you have to use Firebase Admin API.

You do not need to do this in rules. You can just disable that person's userID in the "Authentication" section of the FirebaseConsole
Screenshot attached below as sample
This would be much easier compared to adding into the rules where you have to enter the userID manually anyway.

Firebase: Permission denied - setValue()

I cannot set value to my Firebase Database using setValue(). In logs it returns me setValue at ... Permission denied. I checked my rules:
{
"rules": {
".read": "auth == null",
".write": "auth == null"
}
}

Try changing your rules to the following and it'll work.
{
"rules": {
".read": true,
".write": true
}
}
As per Frank van Puffelen's comment your rules require the user is not authenticated.
You can read more about the authentication rules here for other options if you need more secure authentication
Hope this helps you

Firstly your user must be authenticated as Firebase provide lots of platforms to make user authenticated with it. Example - Google, Facebook, Twitter etc.
As user got authenticate by firebase console he/she get access to relevant database and storage. You can also make a user as a guest by using Firebase anonymous authentication.
By doing authentication every user gets a UID using which you can use to give access to them by writing rules if you want different rules for different users.
{
"rules": {
"users": {
"$uid": {
".read": "$uid === auth.uid",
".write": "$uid === auth.uid"
}
}
}
}
By default you will get something like this in your database rules section :-
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}
This simply means that if the user authenticated then only give them read and write access. Apply to all users.
By doing something like this, you are making your database accessible to everyone and also those people who are not using your product.
{
"rules": {
".read": true,
".write": true
}
}
You can do this for testing purpose of your product, but this is not a secure way.

How to allow read and write access to only auth users in Firebase?

I am new to Firebase and Android. Here in Android, I have one button called sign in which registers auth users in Firebase and I am creating child object in database and I want to allow access to only auth registered users.
So please help me how to change in Firebase rules to allow for only auth users.
Firebase rules are now:
{
"rules": {
".read": true,
".write": true
}
}
auth users register:
Email Providers Created Signed In User UID
xxx#gmail.com Oct 4, 2016 Oct 4, 2016 PZJkEQnQZNZ
and the database:
chat-aa255
- groupchat
- KTOjXlA3Zwy38er
- "msg":"hi"
- "name":"one"
Please help me how to solve this problem. Thanks in advance.

It's because you are not authorized to the Database, check the Rules Tab in the Realtime database
If it's
{
"rules": {
".read": "auth != null",
".write":"auth != null"
}
}
This means only authorized user's can write and read the Data.
Changing to
{
"rules": {
".read": true,
".write":true
}
}
Allows anyone to write the Database
When going for Production be sure to use the first one

Try this, maybe it works:
{
"rules": {
".read": "auth.email == 'xxx#gmail.com'",
".write":"auth != null"
}
}