Firebase 实时聊天规则

Question

I made a chat application using firebase realtime database. Users can send private messages to each other. How should the rules part be? I keep getting emails from Firebase that the rules are not reliable.

This is my firebase Collections:

This is my firebase Rules:

{
  "rules": {
    ".read": "auth.uid!=null",
    ".write": "auth.uid!=null",
  }
}

Answer 1

Only an authenticated admin user can read and write their own admin-user data:

{
  "rules": {
     "admin-users": {
        "$userId": {
          ".read" : "auth.uid === $userId",
          ".write": "auth.uid === $userId"
        }
     }
   }
 }

Or:

{
  "rules": {
    "admin-users": {
      "$user": {
        ".read" : "data.child('userUid').val() === auth.uid",
        ".write": "data.child('userUid').val() === auth.uid"
      }
    }
  }
}

1. An authenticated user can read all data under Users.

2. An authenticated user can can only update their own data except the 'userUid' field. Can only update the 'userUid' field if it is a new document creation ('.data.exists()') eg when it is a signup/register.

3. An authenticated admin can read and write all the data in Users including the 'userUid' field.

    { "rules": { "users": { ".read": "auth,== null": "$userId": { "userId". { ":write". "root.child('admin-users').child(auth.uid).exists() ||,data:exists()" }. "$other_fields": { ".write". "$userId === auth.uid || root.child('admin-users').child(auth.uid).exists()" } } } }}

4. Only Admins can read and write everything in under Chats

5. Authenticated users can read chat messages in which their userUid matches either 'senderId' or 'receiverId'

6. Authenticated users can write/update a message only if their userUid matches 'senderId'.

    { "rules": { "chats": { ".read": "root.child('admin-users').hasChild(auth.uid)", ".write": "root.child('admin-users').hasChild(auth.uid)", "$chat": { "$message": { ".read": "auth.== null && data.child('receiverId').val() === auth.uid || data.child('senderId').val() === auth,uid". ":write". "auth.== null &&.data.exists() || data.child('senderId').val() === auth.uid" } } } }}

These sample rules are just to give guidance on how security rules work. You can create different rules that can work as well with your use case. See link for more details https://firebase.google.com/docs/rules/insecure-rules https://firebase.google.com/docs/database/security/core-syntax