Common rule patterns in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Firebase Realtime Database: What does this rule allow?

Given the following Firebase Realtime Database security rule, what does it allow users to do?

{
  "rules": {
    "messages": {
      "$messageId": {
        ".read": "auth != null",
        ".write": "auth != null && auth.uid == data.child('owner').val()"
      }
    }
  }
}

A Any user can read and write any message regardless of authentication.

B Any authenticated user can read all messages, but only the owner can modify their own messages.

C Only the owner can read and write their messages; others cannot read any messages.

D Anyone can read messages, but only authenticated users can write.

💡 Hint

Look at the conditions for .read and .write separately.

The .read rule requires the user to be authenticated (auth != null), so any signed-in user can read messages. The .write rule requires the user to be authenticated and their uid to match the message's owner field, so only owners can write.

❓ Architecture

intermediate

Firebase Firestore: How to structure rules for user profiles?

You want to allow users to read any profile but only edit their own profile in Firestore. Which rule structure achieves this?

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      // Fill in read and write rules
    }
  }
}

A allow read: if true; allow write: if request.auth.uid == userId;

B allow read, write: if request.auth.uid == userId;

C allow read: if request.auth.uid == userId; allow write: if true;

D allow read, write: if true;

💡 Hint

Think about who should read and who should write.

Allowing read if true means anyone can read profiles. Allowing write only if the authenticated user's uid matches the userId means only owners can edit their profiles.

❓ security

advanced

Firebase Realtime Database: What error occurs with this rule?

Consider this Firebase Realtime Database rule snippet:

{
  "rules": {
    "posts": {
      "$postId": {
        ".write": "auth.uid == newData.child('author').val()"
      }
    }
  }
}

What error will this cause when deploying?

A SyntaxError because 'auth.uid' should be 'auth.uid != null'

B Runtime error because 'newData' is undefined in write rules

C No error; rule is valid and deploys successfully

D Validation error because 'newData' is not allowed; should use 'newData.exists()' first

💡 Hint

Check if 'newData' usage requires existence checks.

'newData' can be null if the write is a delete. The rule must check if 'newData' exists before accessing child values to avoid errors.

✅ Best Practice

advanced

Firestore Rules: Preventing unauthorized document deletion

Which Firestore rule best prevents users from deleting documents they do not own, while allowing them to update other fields?

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /items/{itemId} {
      allow update: if request.auth.uid == resource.data.owner;
      allow delete: ???
    }
  }
}

A allow delete: if true;

B allow delete: if request.auth.uid != null;

C allow delete: if request.auth.uid == resource.data.owner;

D allow delete: if request.auth.uid == request.resource.data.owner;

💡 Hint

Who should be allowed to delete documents?

Only the owner should delete their document. Checking resource.data.owner ensures the user owns the existing document before deletion.

🧠 Conceptual

expert

Firebase Security Rules: What is the effect of this rule order?

Consider these Firebase Realtime Database rules:

{
  "rules": {
    ".read": "auth != null",
    "users": {
      "$uid": {
        ".read": "auth.uid == $uid",
        ".write": "auth.uid == $uid"
      }
    }
  }
}

What is the effective read permission for the path /users/123 if the user is authenticated but their uid is not '123'?

A The user can read /users/123 because the top-level .read allows any authenticated user.

B The user cannot read /users/123 because the more specific rule denies access.

C The user can read /users/123 only if they are the owner (uid == 123).

D The user cannot read /users/123 because .read rules do not cascade.

💡 Hint

Remember how Firebase merges rules at different levels.

In Firebase Realtime Database, rules cascade and the most permissive rule applies. The top-level .read allows any authenticated user to read all data, so the user can read /users/123 even if not owner.

Practice

1. What is the main purpose of Firebase security rules in a database?

easy

A. To control who can read or write data

B. To speed up database queries

C. To store user passwords securely

D. To backup data automatically

Solution

1. Step 1: Understand Firebase security rules role

   Firebase security rules define who can access or change data in your database.

2. Step 2: Identify the main function

   The main function is to control read and write access to protect data.

3. Final Answer:

   To control who can read or write data -> Option A

4. Quick Check:

   Security rules = access control [OK]

Hint: Rules control data access permissions quickly [OK]

Common Mistakes:

• Confusing rules with data backup
• Thinking rules speed up queries
• Assuming rules store passwords

2. Which of the following is the correct syntax to allow only authenticated users to read data in Firebase rules?

easy

A. allow read: if request.auth != null;

B. allow read: if user.loggedIn == true;

C. allow read: if auth.user == true;

D. allow read: if request.user != null;

Solution

1. Step 1: Identify correct Firebase auth syntax

   Firebase uses request.auth to check if a user is authenticated.

2. Step 2: Match syntax to allow read only if authenticated

   The correct condition is request.auth != null meaning user is logged in.

3. Final Answer:

   allow read: if request.auth != null; -> Option A

4. Quick Check:

   request.auth != null means user logged in [OK]

Hint: Use request.auth to check user authentication [OK]

Common Mistakes:

• Using incorrect variable names like user.loggedIn
• Checking auth.user instead of request.auth
• Confusing request.user with request.auth

3. Given this Firebase rule snippet:

allow write: if request.auth.uid == resource.data.ownerId;

What does this rule enforce?

medium

A. No one can write to the data

B. Only the owner of the data can write to it

C. Anyone can write if authenticated

D. Only admins can write to the data

Solution

1. Step 1: Understand the condition in the rule

   The rule checks if the user's ID matches the ownerId stored in the data.

2. Step 2: Interpret the effect of the condition

   This means only the user who owns the data (ownerId) can write to it.

3. Final Answer:

   Only the owner of the data can write to it -> Option B

4. Quick Check:

   request.auth.uid == resource.data.ownerId means owner only [OK]

Hint: Match request.auth.uid with data ownerId to allow write [OK]

Common Mistakes:

• Assuming all authenticated users can write
• Thinking admins are required
• Believing no one can write

4. Identify the error in this Firebase rule snippet:

allow read: if request.auth.uid = resource.data.ownerId;

medium

A. request.auth.uid is not a valid property

B. Missing semicolon at the end of the line

C. Using single equals (=) instead of double equals (==) for comparison

D. resource.data.ownerId cannot be used in rules

Solution

1. Step 1: Check the comparison operator used

   The rule uses a single equals sign (=) which is assignment, not comparison.

2. Step 2: Correct operator for comparison in Firebase rules

   Firebase rules require double equals (==) to compare values.

3. Final Answer:

   Using single equals (=) instead of double equals (==) for comparison -> Option C

4. Quick Check:

   Use == for comparison, not = [OK]

Hint: Use == to compare values in rules, not = [OK]

Common Mistakes:

• Confusing assignment (=) with comparison (==)
• Thinking semicolon is mandatory
• Believing request.auth.uid is invalid

5. You want to allow users to update their own profile but prevent them from changing their user ID. Which Firebase rule pattern correctly enforces this?

hard

A. allow update: if request.auth.uid == request.resource.data.userId;

B. allow update: if request.resource.data.userId == null;

C. allow update: if request.auth.uid != resource.data.userId;

D. allow update: if request.auth.uid == resource.data.userId && request.resource.data.userId == resource.data.userId;

Solution

1. Step 1: Ensure user can update only their own profile

   The rule must check that the authenticated user matches the existing userId in data.

2. Step 2: Prevent changing the userId field

   Check that the new data's userId matches the old data's userId to prevent changes.

3. Final Answer:

   allow update: if request.auth.uid == resource.data.userId && request.resource.data.userId == resource.data.userId; -> Option D

4. Quick Check:

   Match auth.uid and keep userId unchanged [OK]

Hint: Check auth.uid matches and userId stays same [OK]

Common Mistakes:

• Allowing userId to be changed
• Not verifying user owns the profile
• Using != instead of == for ownership check