Search code examples
firebase-realtime-databasefirebase-security

Correctly setup firebase database rules


I have the following rules for my database. My database structure is as follows in the database

enter image description here

My rules for my database are as follows:

{
  "rules": {
    "Users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

If I do a query to read the books under a user or add a new book under a user, will this rule still apply and only allow users who have a correct user id to add the book? Or will I need to drill down to Books and add that rule? Something like...

enter image description here


Solution

  • Permission cascades downwards in the database. So once a user has read or write permission on /Users/$uid they also have that same permission on the Books node under there.

    For more on this, see the documentation on read and write permissions cascase.