Custom functions in rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding custom function usage in Firebase rules

Consider the following Firebase security rule snippet using a custom function:

function isOwner() { return request.auth.uid == resource.data.ownerId; }

What does the isOwner() function check?

A It checks if the user making the request is the owner of the data.

B It verifies if the user is an admin of the Firebase project.

C It checks if the data is publicly readable.

D It validates if the request is coming from a mobile device.

💡 Hint

Look at what request.auth.uid and resource.data.ownerId represent.

The function compares the user ID of the person making the request with the owner ID stored in the data. If they match, the user is the owner.

❓ Configuration

intermediate

Evaluating custom function behavior in Firebase rules

Given this Firebase rule custom function:

function canEdit() { return isOwner() && request.time < resource.data.expiry; }

Which of the following is true about canEdit()?

A It allows editing only if the user is not the owner and the current time is before expiry.

B It allows editing only if the user is the owner and the current time is before expiry.

C It allows editing if the user is the owner or the current time is after expiry.

D It allows editing regardless of ownership or time.

💡 Hint

Focus on the logical AND operator && in the function.

The function returns true only if both conditions are true: the user is the owner and the request time is before the expiry time.

❓ Architecture

advanced

Impact of custom functions on Firebase rule performance

Which of the following statements best describes how custom functions affect Firebase security rule evaluation?

A Custom functions can improve readability but may increase evaluation time if complex or called multiple times.

B Custom functions always reduce evaluation time by caching results automatically.

C Custom functions are ignored during rule evaluation and have no impact on performance.

D Custom functions prevent any other rules from running after they execute.

💡 Hint

Think about how repeated calls to functions affect processing.

While custom functions help organize rules, complex logic or multiple calls can slow down evaluation because each call runs the function code.

❓ security

advanced

Security risks of improper custom function use in Firebase rules

What is a potential security risk when a custom function in Firebase rules uses request.resource.data without validation?

A The function will cause syntax errors and prevent deployment.

B The function will always reject all requests, causing denial of service.

C Attackers could manipulate the request data to bypass security checks.

D Firebase automatically sanitizes <code>request.resource.data</code>, so no risk exists.

💡 Hint

Consider what request.resource.data represents and who controls it.

request.resource.data is data sent by the client. Without validation, malicious users can send crafted data to trick rules.

❓ service_behavior

expert

Determining the output of a Firebase rule with nested custom functions

Given these Firebase security rules:

function isAdmin() { return request.auth.token.admin == true; }
function canDelete() { return isAdmin() || isOwner(); }
function isOwner() { return request.auth.uid == resource.data.ownerId; }

allow delete: if canDelete();

If a user with request.auth.uid = 'user123' and request.auth.token.admin = false tries to delete a document with resource.data.ownerId = 'user123', what will be the result?

A The delete request is denied because the user is not an admin.

B The delete request is denied because the user is neither owner nor admin.

C The delete request is allowed because the user is an admin.

D The delete request is allowed because the user is the owner.

💡 Hint

Check the logic of canDelete() and the user's attributes.

The canDelete() function allows deletion if the user is admin or owner. Here, the user is not admin but is the owner, so deletion is allowed.