Firebase安全规则不起作用

Question

I am using Firebase Authentification in an Web application, and I am using Phone Number authentification as an option to sign in the application.

function saveUser(fname) {
    var user = firebase.auth().currentUser;
    var newUserRef = firebase.database().ref('users/' + user.uid);
    newUserRef.set({
        fname: fname
    });
}

Under the following database rules:

{
  "rules" : {
    ".read"  : false,
    ".write" : false,
    // only authenticated users can write
    "users": {
      ".read": "auth != null",
      "$user_id": {
          "fname": {
            ".read": "auth != null",
            ".write": "auth != null",
            ".validate": "newData.isString() && newData.val().matches(/^[A-Z]{3,}$/)"
          },
      }
    }
  }
}

However, I keep getting the error:

FIREBASE WARNING: set at /users/ypGXpJRM1wdMOuOMf8F7quLnJ073 failed: permission_denied

Is there a way to avoid this error without changing the rules?

Answer 1

The first level where your rules allow writing is in /users/$uid/fname . But your code tries to write to /users/$uid . Since you don't have write permission there, the database rejects the write operation.

You have two options to solve this: allow writes to /users/$uid , or write to /users/$uid/fname .

Allow writes to /users/$uid

To allow writes to /users/$uid change your rules to:

"users": {
  ".read": "auth != null",
  "$user_id": {
      ".write": "auth != null",
      "fname": {
        ".read": "auth != null",

In fact, you'll likely want to ensure a user can only write their own node, which you do with:

"users": {
  ".read": "auth != null",
  "$user_id": {
      ".write": "auth.uid === $uid",
      "fname": {
        ".read": "auth != null",

Write to /users/$uid/fname

Your current write code tries to write to a place where you don't have permission. Since you are only writing the fname , you can also write to that specific location to get rid of the error:

var newUserRef = firebase.database().ref('users/' + user.uid);
newUserRef.child('fname').set(fname);

Given the data structure I'd probably go for modifying the security rules.

Answer 2

These rules are blocking all access:

".read"  : false,
".write" : false,

You can easily test your db security rules in Firebase database rule simulator tool.