Develop Reference

Realtime Database from insecure to secure rules without interrupting services

Today, I received an email which states,
[Firebase] Your Realtime Database 'CC-default-rtdb' has insecure rules, any user can read your entire database, any user can write to your entire database
My server runs every day to store values in the Realtime Database. When I started this Firebase project, I used the basic read and write rules.
{
"rules": {
".read": true,
".write": true
}
}
If I change the rules now, does it affect my external Node.JS server from storing values into the Realtime DB?
I even access this DB from a mobile app, so will it affect the mobile app from reading data if the rules are changed?
How can I secure these Realtime DB rules (from public to private) without interrupting the access for the external server and mobile app? Importantly, my external server access must not get disrupted.

If you are accessing your database through authentication(login) you can set your nodes to auth!=null so that any unauthorized user cannot access them.
You need to follow the following steps:
Set read to true for all nodes you need to make publicly available
Set read/write to auth!=null for all nodes you want to make available to any authorized user
Set custom validation rules for any node that needs special access (e.g.: A user can only write to his/her data)
As per the screenshot, if anyone gets a hold of your project id, they can modify and steal your entire database.
You need to set rules in a way that properly matches your use case. As far as I understand:
Allow the external server account access to the whole DB
Allow the mobile app conditional access (by user perhaps?)
Example
Take this database for instance:
{
"top_level": {
"users": [
{
"username": "X",
"userId": "0"
},
{
"username": "Y",
"userId": "1"
}
],
"public_data": {
"news": [
{
"title": "X",
"body": "Y"
}
]
}
}
}
I want to set:
Node "news" to be publicly available to read (no auth)
Node "users" to be only available to other logged-in users to read(auth)
Children of node "users" to only be writable for the user whose id matches the value userId in the node
The rule, in this case, would be:
{
"rules": {
".read": false,
".write": false,
"top_level": {
"users": {
".read": "auth!=null",
"$user_id": {
".write": "auth!=null && data.child('userId').val()===auth.uid"
}
},
"news" : {
".read":true
}
}
}
}
Note, rules set as true in the top-level override inner rules.
Comment if you need clarification.

How to restrict users access to database in firebase firestore?

My requirement:
Total No of users:4
User1:Can submit his data. And if he pressed a button he can able see all 4users data.
Same like for other 3users also.
How can I achieve it?

You need to structure your database something like this:
users: {
userId1: {
...userData
}
}
Basically you need to separate data of each user in separate nodes.
Then use these security rules:
{
"rules": {
"users": {
"$uid": {
".write": "$uid === auth.uid"
".read": true
}
}
}
}
Now the user can write to his/her data only but everyone can read it.

you can use database security rules, https://firebase.google.com/docs/database/security/
and i suggest you structure your data in database like
/data/<userId> and limit the user write access to its userId
of course you also need to implement firebase auth.

How to query Firebase-DB for data like 'WHERE'-clause?

I'm working on a contact-app for android with firebase and I want to read values (here: the users' profile) from a user in my database that matches a specified email.
I tried to design the query like shown in this answer: https://stackoverflow.com/a/39025129/8739722 but the problem is that I don't know how to apply this to my database-structure since I have another child (profile) in my user-structure.
My Nodes look like this:
My Rules look like this:
{
"rules": {
"users": {
"$uid": {
"profile": {
".read": "auth.uid != null",
".write": "auth.uid == $uid",
},
//...
},
}
I tried to query like this:
String email = "email_address_1";
Query q_1 = ref.child("users").child("profile").orderByChild("email").equalTo(email);
...resulting in a 'permission denied' error.
I also considered following queries but they have invalid syntax or try to perform multiple orderByChild-calls which is not allowed:
String email = "email_address_1";
Query q_2 = ref.child("users").orderByChild("profile").child("email").equalTo(email);
Query q_3 = ref.child("users").orderByChild("profile").orderByChild("email").equalTo(email);
How can I get the profile-information of the user with the matching email?

Firebase Realtime Database queries filter and order on a single property that is under a fixed path/name under each child node of the location where you run the query. In your case the property is under profile/email, so your query becomes:
ref.child("users").orderByChild("profile/email").equalTo(email);
But note that your rules will reject this query, since they request to read data from /users and you don't grant anyone permission to read data from there. Firebase security rules are enforced when you attach a listener, and can't be used to filter data. To learn a lot more about this, read the documentation section called rules are not filters and the many questions mentioning that same phrase.
To quickly test the above query, you can temporarily grant every access to /users. Just be sure to change it back before sharing your app with any users.
To properly secure the data you'll need to verify in your security rules that the user is only trying to read their own data. You can do this with query based security rules. In your case they'd look something like this:
"users": {
".read": "auth.email != null &&
query.orderByChild == 'profile/email' &&
query.equalTo == auth.token.email"
}

Firebase update fields only when its empty

I have a data set on firebase real time database like this.
Users
---Match
------User1
mId:"12345"
xId:""
------User2
mId:"54321"
xId:""
Basically developing a multi player matching functionality here using android application.Assuming user 1 matched with user 2. User1 will update his own xId value with user2 mId value and user2 will update his own xId value with mId value of user1.
This works fine if there are two users. Both connects to each other and works well. Issue comes when 3 users come at the same time. User1 writes to user2 and user2 writes to user3 and creates inconsistent data set.
I want to lock a value once it is changed or we can say a simple rule like.
update user1 only : if(user1.xid=="")
update user2 only : if(user2.xid=="")
Is it possible using firebase security rule?

To only allow writing new data (so never overwrite or delete existing data), you'll want this rule:
{
"rules": {
"Users": {
"Match": {
"uid": {
".validate": "!data.child('xid').exists() && newData.child('xid').exists()"
}
}
}
}
}
For more elaborate information check out the Firebase documentation for security rules, specifically the section on New vs. Existing Data.

Firebase check if a value exists without reading a snapshot or trying a write (for unique usernames)?

I've been stuck on this problem for many hours now, so any help is appreciated. Trying to make an Android app with Firebase for user authentication (simple-login email and password) along with unique usernames. I have my sign-up screen fields laid out on a single screen e.g.:
"Enter Username"
"Enter Email Address"
"Enter Password"
I'm very confused as how how to query the database to check if the username exists or not without reading a database snapshot and without attempting to write the username to the database (because this is happening while the user is in state auth == null, so while on the sign-up page before the user has created his account I want to inform the user whether his username is taken or not).
I mean, this feels like it should be very simple, just a simple query to Firebase with a string and just getting Firebase to return True or False, but after hours of googling I could find nothing.
The reason I don't want to use a snapshot to do this is because I do not want to expose all my user's names and their UIDs to the public by setting "read" to true (I followed this guide so my security rules are set up just like this, along with my database structure Firebase android : make username unique).
Here are my rules, and they work currently (I don't like the fact that the read is set to True which is why I'm asking the question though):
{
"rules": {
"usernames": {
".read": true,
"$username": {
".write": "auth !== null && !data.exists()"
}
},
"users": {
"$uid": {
".write": "auth !== null && auth.uid === $uid && !data.exists()",
".read": "auth !== null && auth.provider === 'password' && auth.uid === $uid",
"username": {
".validate": "(!root.child('users').child(newData.val()).exists() || root.child('usernames').child(newData.val()).val() == $uid)"
}
}
}
}
}
And this is my data:
{
"usernames" : {
"abcd" : "some-user-uid"
},
"users" : {
"\"some-user-uid\"" : {
"username" : "abcd"
}
}
}
Thanks!

There is unfortunately, no way to test whether the data exists without actually downloading it via the SDK. Data structures are going to be supreme here (recommended reading: NoSQL Data Structures and you shouldn't be afraid to denormalize a bit of data when optimization and scale are critical.
Generally speaking, you should keep your data well structured so payloads are small and fetch it. If you're fetching something that can't wait for the bytes to be fetched (e.g. games, strange one-off admin ops on very large data sets, et al) then here are a few reasonable approaches to simulate this:
Fetching a list of keys via the REST API
Using the attribute shallow=true in a call to the REST API will prevent loading of a large data set and return only the keys at that path. Note that if you store a million records, they still have to be loaded into memory on the server (slow) and you still have to fetch a million strings (expensive).
So one way to check the existence of data at a path, without actually downloading the data, would be to make a call to the path, such as https://<YOUR-FIREBASE-APP>.firebaseio.com/foo.json?shallow=true, and check whether any keys are returned.
Creating a denormalized index you can query instead
If you really need to squeeze some extra performance and speed out of your Firebase Database (hint: you don't need this unless you're running millions of queries per minute and probably only for gaming logic and similar), you can dual-write your records (i.e. denormalize) as follows:
/foo/data/$id/... data goes here...
/foo/index/$id/true (just a boolean value)
To dual write, you would use the update command, and a write similar to the following (Android SDK sample):
public void addRecord(Map<String, Object> data) {
DatabaseReference db = FirebaseDatabase.getInstance().getReference();
// create a new record id (a key)
String key = db.child("foo").push().getKey();
// construct the update map
Map<String, Object> dualUpdates = new HashMap<>();
dualUpdates.put("/data/" + key, /* data here */);
dualUpdates.put("/index/" + key, true);
// save the new record and the index at the same time
db.child("foo").updateChildren(dualUpdates);
}
Now to determine if a record exists, without actually downloading the data, I can simply query against /foo/index/$id and try DataSnapshot.exists(), at the cost of downloading a single boolean.