Search code examples
firebasefirebase-realtime-databasefirebase-securityfirebase-console

Firebase DB rules simulator allow read and write by unauthenticated users

The simulator allows read/write to Posts key, but the results are correct for the Users key rules. Each post under Posts has a uid value representing a user in Users key.

Are my rules wrong or is the simulator wrong? Be gentle, I'm new to Firebase. :)

Screenshot

Two equals:

Screen

Redacted Data view:

Screen

Solution

  • Try changing your rules to check that a uid child exists. For example:

    ".read": "data.child('uid').exists() && data.child('uid').val() === auth.uid"

    Based on a quick test, I think what is occuring is that when a uid child does not exist, the evaluation of data.child('uid').val() fails and is handled by assigning it a value of false. Similarly, because the user is not authenticated, auth is null and auth.uid also evaluates to false. So your rule effectively becomes ".read": "false === false", which is true.

    When I first simulated a read using your rule and I did not have a uid child in my database under /posts/1, the read was granted, as you reported. When I added a uid child, it was not granted.