Sorry if this seems like a dumb question but the Firebase docs go round in circles.
I'm building an Android app and I'm authenticating users using mAuth.createUserWithEmailAndPassword documented here - https://firebase.google.com/docs/auth/android/start/
That's straightforward and I can set the username, email etc. and its all stored somewhere (I've no idea where as its not displayed in the Firebase console) BUT I'm confused about user based authentication - https://firebase.google.com/docs/database/security/user-security in the examples here (and elsewhere on the net) we see the rules starting with users
{
"rules": {
"users": {
"$user_id": {
// grants write access to the owner of this user account
// whose uid must exactly match the key ($user_id)
".write": "$user_id === auth.uid"
}
}
}
}
As far as I can see in the Firebase console there is no users child node in the database generated automatically from mAuth.createUserWithEmailAndPassword. So my question is should I create this or was a users child automatically created I just can't see it?
Its not a lot of work to implement an additional user child node and store user information there but it seems like a lot of duplication given that the authentication procedure has already stored the user information somewhere. The opposite way to ask this question is can I add the db write rules above and expect them to work if I have authenticated users but never added a users node in the db myself?
Why the docs don't spell this out is beyond me
Related
I am working on a simple react-native To-do app with sharing features. I am using Firebase Storage for storage and sharing. However, I am a beginner to Firebase and couldn't understand how to proceed. My requirements are as follows
Each user can add/remove/edit their own database entry.
User A should be able to share some of their To-dos with User B. The share can be in either view or edit mode (exactly like a Google Drive file).
An option to permanently allow User B to see all future view or edit mode for any new to-dos. Basically, an option to allow or disallow User B to see the data.
My attempt:
Bullet 1 can be achieved simply by
// These rules grant access to a node matching the authenticated
// user's ID from the Firebase auth token
{
"rules": {
"users": {
"$uid": {
".read": "$uid === auth.uid",
".write": "$uid === auth.uid"
}
}
}
}
source
For Point 2 and Point 3, I plan to have a separate JSON file accessible by all the users. So when user A gives edit access to some of its data to User B, the JSON file for user B should be updated with A's uid. I am not able to write security rules for this because I am not aware if we can write rules to get data from a JSON file. Also, this method is not very good in my opinion, as some attacker may flood User B's JSON file with garbage entries and in fact can delete the existing entries also.
Any help to achieve this Google Drive-like sharing feature for Firebase storage will be appreciated. Thanks!
You can allow who can write or read particular path in rules
if your database looks something like this:-
your rule can look something like this:-
"rules": {
"$uid":{
"$todoid":{
"todoitem":{
".read":"$uid == auth.uid || data.parent().child('sharedwith').child(auth.uid).val() === 'editor' || data.parent().child('sharedwith').child(auth.uid).val() === 'editor'",
".write":"$uid == auth.uid || data.parent().child('sharedwith').child(auth.uid).val() === 'editor'"
}
}
}
}
you can follow this blog post to understand better:- https://firebase.googleblog.com/2016/10/group-security-in-firebase-database.html
Am glad that you are trying to work with Firebase Realtime Database Rules.
Firstly I guess you understood concept of rules in a different way. The rules in firebase is not built to have User specific data control. These rules are used to give certain data access to certain type of users
For example :
You can give R/W permission to specific child to the users who are only Authenticated. For the one who not authenticated we can restrict the access
Main motive of this Rules tab is to avoid Data breaching from a 3rd party access
To know more about firebase rules please watch video in the given. link
https://www.youtube.com/watch?v=PUBnlbjZFAI
You can also see this Documentation
https://firebase.google.com/docs/database/security
I am working on one the Android APP & want to integrate it with the Firebase & it's Realtime Database. I have a list of 1000 users(Excel) with details like EmpId, EmpName, Team, Mobile Number, etc.
I want to restrict my APP only to the users from this list & also want to authenticate them using the mobile number present in the list against there name.
Can I use Firebase Auth for the above requirement & if yes, how to do that?
If with FireBase Auth, this is not possible what is the alternative solution?
Please help.
Firebase Authentication only allows the users to identify themselves. What you're describing is limiting what users are allowed to use your app, which is known as authorization, and Firebase Authentication doesn't handle that.
Luckily you tagged with firebase-realtime-database too, and authorization is definitely built into that. What I'd usually do is create a top-level node in the database that contains the UID of users that are allowed to use the app:
"allowedUsers": {
"uidOfUser1": true,
"uidOfUser2": true
...
}
Then in other security rules you'll check if the user's UID is in this list before allowing them access to data, with something like:
{
"rules": {
"employees": {
".read": "root.child('allowedUsers').child(auth.uid).exists()",
"$uid": {
".read": "auth.uid === $uid && root.child('allowedUsers').child(auth.uid).exists()"
}
}
}
}
With these rules:
Allowed users that are signed in can read all employee data.
But they can only modify their own employee data.
Of course you'll want to modify these rules to fit your own requirements, but hopefully this allows you to get started.
A few things to keep in mind:
The UID is only created once the users sign up in Firebase Authentication. This means you may have to map from the email addresses you have to the corresponding UIDs. You can either do this by precreating all users, do it in batches, or use a Cloud Function that triggers on user creation to add the known users to the allowedUsers list.
Alternative you can store the list of email addresses in the database. Just keep in mind that somebody could sign in with somebody else's email address, unless you require email address verification. Oh, and you can't store the email address as a key in the database as-is, since . characters are not allowed, so you'll have to do some form of encoding on that.
Also see:
How do I lock down Firebase Database to any user from a specific (email) domain? (also shows how to check for email verification)
Restrict Firebase users by email (shows using encoded email addresses)
firebase realtime db security rule to allow specific users
How to disable Signup in Firebase 3.x
Firebase - Prevent user authentication
I know it's late but for anyone who may be referencing this question, my recommendation is blocking functions. You essentially create a Firebase Cloud Function that can accept or deny requests to make an account. Here's what it could look like:
const functions = require('firebase-functions');
exports.beforeCreate = functions.auth.user().beforeCreate((user, context) => {
var allowedUsers = ['johndoe#stackoverflow.com'];
// if they are not in the list, they cannot make an account
// throwing this error will prevent account creation
if(allowUsers.indexOf(user.email) == -1) throw new functions.auth.HttpsError('permission-denied');
});
This way is better in my opinion because the security rules doesn't have to reference the database. Instead, the security rules can allow requests from any authenticated user, because the only authenticated users are ones allowed by this function.
I have developed an app on Android that uses the Firebase realtime database. aka multiple nodes in the DB store various data collected by my app. For Auth, email/password-based Sign-in and Sign-up are working properly. When I sign-up a new user the auth works but that new user then needs to be granted access to the firebase database nodes the app uses. My app needs to grant this new user access to the firebase database nodes required for app interaction.
In other words, how do I programmatically, via my app, change the firebase node-access/security rules in my app (when I currently only know how to change these via the Firebase browser UI)? I do not see methods in FirebaseAuth to do this. So, where do I go from here?
Also, obviously a new user of my app will not have my credentials but they must be able to add access for themselves to my existing firebase realtime database nodes. How do I this?
Here are the rules I have in place today (where my UID is my actual firebase UID):
{
"rules": {
".read": "auth.uid === my UID",
".write": "auth.uid === my UID"
}
}
I now understand I must set rules to allow all authenticated users to read write data in various nodes of my tree. I do not yet understand how to grant access by node and particularly by a specific uid-based node in a tree where there may be many UIDs for each user. As an example, if my tree is root (top), then messages, then a UID for each user, what is the syntax for an authorization rule that will allow the current user/UID read/write the data in only his/her UID under root, messages, his/her user UID?
i am building a chat android app that allows users to chat where users can create account and use all the features. It's about to be completed but there's a problem, actually a question.
Is firebase on android safe ?
In my firebase database, i have created a rule as follow:
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}
Now, this rule will reject any non authenticated users from accessing the data and pushing data or deleting any of it. But, when user creates an account on my chat app, he/she will be authenticated and my app will allow to make modifications. What if they reversed engineered the app and changed some of the codes and pushed invalid datas or removed some of the values from database coz they are already authenticated ?? How can i prevent that ?
When user creates account in my app i use:
auth.createUserWithEmailAndPassword(email, password)
.addOnCompleteListener(RegisterActivity.this, new OnCompleteListener<AuthResult>() {
This will create a new chat user for the app. So, user is creating his/her own account and they know the credentials and everything. I am so confused, how can i prevent them from editing my codes ?
You can't prevent malicious clients from executing whatever code they want against your Firebase project. Someone will always find a way to compromise your app at runtime on a device that you can't fully control.
The way to protect your data is through sophisticated security rules that:
Requires users to be authenticated (as you already have)
Decide which users can read and write to which locations in your database
Reject invalid data from being written
This requires a fair amount of thought and effort. You can start with the documentation to learn more.
Please also read this question on Quora for some more ideas.
How do I prevent other users from accessing my Realtime Database via my Firebase URL? What must I do to secure it to only my domain?
First of all, understand that you cannot secure any URL on the internet according to the origin domain--malicious users can simply lie. Securing the origin domains is only useful in preventing cross-site spoofing attacks (where a malicious source pretends to be your site and dupes your users into logging in on their behalf).
The good news is that users are already prevented from authenticating from unauthorized domains from the start. You can set your authorized domains in Forge:
type your Firebase url into a browser (e.g. https://INSTANCE.firebaseio.com/)
log in
click on the Auth tab
add your domain to the list of Authorized Requests Origins
select a "provider" you want to use and configure accordingly
Now to secure your data, you will go to the security tab and add security rules. A good starting point is as follows:
{
"rules": {
// only authenticated users can read or write to my Firebase
".read": "auth !== null",
".write": "auth !== null"
}
}
Security rules are a big topic. You will want to get up to speed by reading the overview and watching this video
Setup security Rules,
source to learn : https://firebase.google.com/docs/rules
Use Emulators (It will make keys not easy to visible by beginner programmers)
, source : https://firebase.google.com/docs/rules/emulator-setup
Cloud Functions (It will hide the names of Collections and Docs)
, https://firebase.google.com/docs/functions
Limit the API keys to specific website/s(It will make peoples unable to access your website/app from outside)
if someone knows more methods, please tell, no one can be perfect.