Authentication-based rules in Firebase - Step-by-Step Execution

Process Flow - Authentication-based rules

User tries to access data

↓

Check if user is signed in

↓

Allow access

↓

Perform requested operation

This flow shows how Firebase checks if a user is signed in before allowing access to data.

Execution Sample

Firebase

service cloud.firestore {
  match /databases/{database}/documents {
    match /messages/{messageId} {
      allow read, write: if request.auth != null;
    }
  }
}

This rule allows read and write access to messages only if the user is authenticated.

Process Table

Step	User Signed In?	Condition (request.auth != null)	Access Granted?	Action
1	Yes	True	Yes	Allow read or write
2	No	False	No	Deny read or write

💡 Access is granted only if the user is signed in (request.auth is not null). Otherwise, access is denied.

Status Tracker

Variable	Start	After Step 1	After Step 2
request.auth	null	User object (authenticated)	null
Access Granted	No	Yes	No

Key Moments - 2 Insights

Why does access get denied when request.auth is null?

Because the rule explicitly checks if request.auth is not null to allow access. When it is null, the condition fails and access is denied, as shown in execution_table row 2.

What does request.auth represent in these rules?

request.auth represents the user's authentication state. If the user is signed in, it contains user info; if not, it is null. This is why the condition checks for request.auth != null.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'Access Granted?' when the user is not signed in?

A No

B Yes

C Maybe

D Depends on data

💡 Hint

Check execution_table row 2 under 'Access Granted?' column.

At which step does the condition 'request.auth != null' evaluate to true?

A Both steps

B Step 2

C Step 1

D Neither step

💡 Hint

Look at execution_table rows and see when the user is signed in.

If we remove the condition 'request.auth != null', what would happen to access control?

A Access would always be denied

B Access would always be granted

C Access would depend on user role

D Access would depend on data content

💡 Hint

Think about the condition controlling access in the execution_table and variable_tracker.

Concept Snapshot

Firebase Authentication Rules:
- Use 'request.auth != null' to check if user is signed in.
- Allow access only if user is authenticated.
- Deny access if user is not signed in.
- Applies to read and write operations.
- Simple and secure way to protect data.

Full Transcript

This visual execution shows how Firebase Authentication-based rules work. When a user tries to access data, Firebase checks if the user is signed in by verifying if 'request.auth' is not null. If the user is signed in, access is granted for read or write operations. If not, access is denied. The execution table traces these steps clearly. Variables like 'request.auth' and 'Access Granted' change accordingly. Key moments clarify why access is denied when not signed in and what 'request.auth' means. The quiz tests understanding of these steps. This helps beginners see how authentication controls data access simply and securely.