Security Rules: checking for null auth
For each security rule, is it necessary to always check auth !== null? It seems redundant to have to do this for every child rule.
I checked Firebase's own Firechat security rules and the enforcement is not consistent at all. There are rules that use auth.uid but do not check for null auth.
What happens if auth is null and auth.uid is used in the rule?
And what is the recommended practice regarding checking auth !== null?
Copyright License：
Author:「Norman Cheng」,Reproduced under the CC 4.0 BY-SA copyright license with link to original source & disclaimer.
Link to：https://stackoverflow.com/questions/34033300/security-rules-checking-for-null-auth
About “Security Rules: checking for null auth” questions
For each security rule, is it necessary to always check auth !== null? It seems redundant to have to do this for every child rule.
I checked Firebase's own Firechat security rules and the enforcem...
|
I am unsuccessfully trying to tighten Firestore security with custom claims.
versions:
Firebase: ^9.6.9
Node: 16.14.0
Next: 11.1.0
I have verified that my custom claims are set as they work as ex...
|
I was wondering if checking a 'database value' (example below) for a user is equally, more, or less secure than 'checking auth' (example below).
Could checking the 'database value' be secure enough...
|
I created my app with the following database structure
Root/
Users/
+12345566777
+12345667765
+43223456677
And here it is an example of my security rules
{
"rules": {&
|
Im having trouble with the security rules for firebase and Im not 100% where I am going wrong. I am thinking that maybe I have my data structure wrong:
{
"users": {
"uid": {
"displayNa...
|
The legacy Firebase documentation indicates that you can insert properties into the auth object that is used in database security rules. Indeed I had this approach working quite nicely in my app b...
|
I try to compare the request.auth.token.name with the document name in the Firestore Security Rules, to give only the user access to his specific document. Unfortunately, it still doesn't work out. I
|
I have to add a set of rules in Firebase "Security & Rules" but can't find it in the new version. Rules are the following. I am referring to this manual for adding these rules to "Security &
|
I want to create a firebase rule where people can use the database without having to login. But I also want to make a private user node where only the user can acces it by authenticating so far I h...
|
I stored my portfolio app data using Firestore and firebase storage.
There are no user inputs or registration in my app, it's a simple portfolio to show my works.
I want any user to be able to read...
|
|
|