Custom functions in rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding custom function usage in Firebase rules

Consider the following Firebase security rule snippet using a custom function:

function isOwner() { return request.auth.uid == resource.data.ownerId; }

What does the isOwner() function check?

A It checks if the user making the request is the owner of the data.

B It verifies if the user is an admin of the Firebase project.

C It checks if the data is publicly readable.

D It validates if the request is coming from a mobile device.

💡 Hint

Look at what request.auth.uid and resource.data.ownerId represent.

The function compares the user ID of the person making the request with the owner ID stored in the data. If they match, the user is the owner.

❓ Configuration

intermediate

Evaluating custom function behavior in Firebase rules

Given this Firebase rule custom function:

function canEdit() { return isOwner() && request.time < resource.data.expiry; }

Which of the following is true about canEdit()?

A It allows editing only if the user is not the owner and the current time is before expiry.

B It allows editing only if the user is the owner and the current time is before expiry.

C It allows editing if the user is the owner or the current time is after expiry.

D It allows editing regardless of ownership or time.

💡 Hint

Focus on the logical AND operator && in the function.

The function returns true only if both conditions are true: the user is the owner and the request time is before the expiry time.

❓ Architecture

advanced

Impact of custom functions on Firebase rule performance

Which of the following statements best describes how custom functions affect Firebase security rule evaluation?

A Custom functions can improve readability but may increase evaluation time if complex or called multiple times.

B Custom functions always reduce evaluation time by caching results automatically.

C Custom functions are ignored during rule evaluation and have no impact on performance.

D Custom functions prevent any other rules from running after they execute.

💡 Hint

Think about how repeated calls to functions affect processing.

While custom functions help organize rules, complex logic or multiple calls can slow down evaluation because each call runs the function code.

❓ security

advanced

Security risks of improper custom function use in Firebase rules

What is a potential security risk when a custom function in Firebase rules uses request.resource.data without validation?

A The function will cause syntax errors and prevent deployment.

B The function will always reject all requests, causing denial of service.

C Attackers could manipulate the request data to bypass security checks.

D Firebase automatically sanitizes <code>request.resource.data</code>, so no risk exists.

💡 Hint

Consider what request.resource.data represents and who controls it.

request.resource.data is data sent by the client. Without validation, malicious users can send crafted data to trick rules.

❓ service_behavior

expert

Determining the output of a Firebase rule with nested custom functions

Given these Firebase security rules:

function isAdmin() { return request.auth.token.admin == true; }
function canDelete() { return isAdmin() || isOwner(); }
function isOwner() { return request.auth.uid == resource.data.ownerId; }

allow delete: if canDelete();

If a user with request.auth.uid = 'user123' and request.auth.token.admin = false tries to delete a document with resource.data.ownerId = 'user123', what will be the result?

A The delete request is denied because the user is not an admin.

B The delete request is denied because the user is neither owner nor admin.

C The delete request is allowed because the user is an admin.

D The delete request is allowed because the user is the owner.

💡 Hint

Check the logic of canDelete() and the user's attributes.

The canDelete() function allows deletion if the user is admin or owner. Here, the user is not admin but is the owner, so deletion is allowed.

Practice

1. What is the main benefit of using custom functions in Firebase security rules?

easy

A. They make rules easier to read and reuse common checks

B. They automatically fix security vulnerabilities

C. They increase the speed of database queries

D. They replace the need for authentication

Solution

1. Step 1: Understand the purpose of custom functions

   Custom functions in Firebase rules are designed to simplify and organize security logic by reusing common checks.

2. Step 2: Compare options to the purpose

   Only They make rules easier to read and reuse common checks correctly states that custom functions make rules easier to read and reuse common checks. Other options describe unrelated or incorrect benefits.

3. Final Answer:

   They make rules easier to read and reuse common checks -> Option A

4. Quick Check:

   Custom functions improve readability and reuse = A [OK]

Hint: Custom functions simplify and reuse checks in rules [OK]

Common Mistakes:

• Thinking custom functions speed up queries
• Believing they fix security automatically
• Confusing them with authentication features

2. Which of the following is the correct syntax to define a custom function named isOwner in Firebase rules?

easy

A. function isOwner() = request.auth.uid == resource.data.owner;

B. isOwner() => request.auth.uid == resource.data.owner;

C. function isOwner() { return request.auth.uid == resource.data.owner; }

D. isOwner() { return request.auth.uid == resource.data.owner; }

Solution

1. Step 1: Recall Firebase rules function syntax

   Firebase rules use the syntax: function name() { return expression; } to define custom functions.

2. Step 2: Identify the correct syntax

   function isOwner() { return request.auth.uid == resource.data.owner; } matches the correct syntax. isOwner() { return request.auth.uid == resource.data.owner; } omits the required function keyword. Options B and C use invalid syntax.

3. Final Answer:

   function isOwner() { return request.auth.uid == resource.data.owner; } -> Option C

4. Quick Check:

   Firebase custom function syntax uses function name() { return ... } = A [OK]

Hint: Firebase rules functions use function name() { return ... } syntax [OK]

Common Mistakes:

• Omitting the 'function' keyword
• Using arrow functions which are not supported
• Using '=' instead of function body block

3. Given the following Firebase rule snippet:

function isAdmin() { return request.auth.token.admin == true; }
allow write: if isAdmin();

What happens if request.auth.token.admin is false?

medium

A. Write access is denied

B. Write access is granted

C. Rule throws a syntax error

D. Write access is granted only if user is authenticated

Solution

1. Step 1: Understand the function logic

   The function isAdmin() returns true only if request.auth.token.admin is true.

2. Step 2: Evaluate the rule condition

   The write permission is allowed only if isAdmin() returns true. If request.auth.token.admin is false, the function returns false, so write is denied.

3. Final Answer:

   Write access is denied -> Option A

4. Quick Check:

   isAdmin false means no write access = A [OK]

Hint: Function returns false blocks access; true allows it [OK]

Common Mistakes:

• Assuming false admin still grants access
• Thinking rule throws error on false
• Confusing authentication with admin check

4. Identify the error in this Firebase rule custom function:

function isOwner() {
  request.auth.uid == resource.data.owner;
}
allow read: if isOwner();

medium

A. Incorrect function name syntax

B. Invalid comparison operator

C. Using 'allow' outside match block

D. Missing return statement inside the function

Solution

1. Step 1: Check function body for return

   The function compares values but does not return the result, so it returns null by default.

2. Step 2: Understand impact on rule

   Without a return, isOwner() returns null (falsey), so the rule will deny access unexpectedly.

3. Final Answer:

   Missing return statement inside the function -> Option D

4. Quick Check:

   Functions must return values explicitly = B [OK]

Hint: Always return a value in custom functions [OK]

Common Mistakes:

• Forgetting to add 'return' before expression
• Assuming last line auto-returns value
• Misplacing 'allow' statements

5. You want to create a reusable custom function canEdit() that allows editing if the user is either the owner or has an admin role. Which of the following is the correct way to write this function in Firebase rules?

hard

A. canEdit() { if (request.auth.uid == resource.data.owner) return true; else return false; }

B. function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; }

C. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; }

D. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin; }

Solution

1. Step 1: Understand the logic needed

   The function should return true if the user is owner OR has admin role.

2. Step 2: Analyze each option

   function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } correctly uses function keyword, logical OR (||) and explicit admin comparison. canEdit() { if (request.auth.uid == resource.data.owner) return true; else return false; } only checks owner. canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } and canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin; } omit required function keyword.

3. Final Answer:

   function canEdit() { return request.auth.uid == resource.data.owner || request.auth.token.admin == true; } -> Option B

4. Quick Check:

   function keyword + OR + admin == true = B [OK]

Hint: Use function keyword, || and explicit admin == true check [OK]

Common Mistakes:

• Using AND instead of OR for conditions
• Not explicitly comparing admin to true
• Ignoring admin role in logic