Custom functions in rules in Firebase - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a custom function in Firebase security rules?

A custom function is a reusable block of code inside Firebase security rules that helps simplify and organize rule logic by grouping repeated checks or calculations.

beginner

How do you define a custom function in Firebase rules?

You define a custom function using the <code>function</code> keyword followed by the function name and parameters inside parentheses and curly braces. For example: <br><code>function isOwner(userId) { return userId == request.auth.uid; }</code>

beginner

Why use custom functions in Firebase rules?

Custom functions make rules easier to read, maintain, and avoid repeating the same logic multiple times. They help keep rules clean and reduce errors.

intermediate

Can custom functions in Firebase rules access request data?

Yes, custom functions can access request and resource objects to check authentication, data values, or other request details needed for security decisions.

intermediate

Example: What does this custom function do?<br><code>function isAdmin() { return request.auth.token.admin == true; }</code>

This function checks if the authenticated user has an admin flag set to true in their authentication token, meaning they have admin privileges.

What keyword is used to define a custom function in Firebase security rules?

A def

B function

C func

D lambda

Firebase security rules use the keyword function to define custom functions.

Can custom functions in Firebase rules help reduce repeated code?

A Yes, they make rules cleaner and reusable

B No, they increase code duplication

C Only if you use external libraries

D Only for read operations

Custom functions allow you to reuse logic, reducing repetition and making rules easier to maintain.

Which object can custom functions access to check the user's identity?

A storage.bucket

B resource.data

C database.ref

D request.auth

The request.auth object contains authentication info about the user making the request.

What is a good reason to use custom functions in Firebase rules?

A To store user data

B To slow down rule evaluation

C To make rules easier to read and maintain

D To bypass security checks

Custom functions improve readability and maintainability of security rules.

Which of these is a valid custom function call in Firebase rules?

A isOwner(resource.data.userId)

B call isOwner(resource.data.userId)

C invoke isOwner(resource.data.userId)

D run isOwner(resource.data.userId)

Custom functions are called by their name followed by parentheses with arguments, like isOwner(resource.data.userId).

Explain what custom functions are in Firebase security rules and why they are useful.

Think about how you avoid repeating yourself in code.

Describe how you would write a custom function to check if the current user is the owner of a data item.

Focus on comparing user IDs.