Data validation rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a Firebase Realtime Database rule denies a write?

You have a Firebase Realtime Database rule that denies write access to a path. What is the result when a client tries to write data to that path?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/ {
    match /users/{userId} {
      allow write: if false;
    }
  }
}

A The write is accepted and data is saved regardless of the rule.

B The write is accepted but data is not saved.

C The write is queued and retried later automatically.

D The write is rejected and the client receives a permission denied error.

💡 Hint

Think about what happens when rules explicitly deny access.

If a rule denies write access, Firebase rejects the write immediately and returns a permission denied error to the client. The data is not saved.

🧠 Conceptual

intermediate

Which Firebase Realtime Database rule condition checks if a user is authenticated?

In Firebase Realtime Database rules, which condition correctly checks if the user is signed in?

A auth != null

B user != null

C request.auth == true

D auth.isSignedIn == true

💡 Hint

Firebase uses a special variable to represent authentication info.

The variable auth is null if the user is not signed in. Checking auth != null confirms the user is authenticated.

❓ Configuration

advanced

Which rule correctly validates that a 'score' field is an integer between 0 and 100?

You want to write a Firebase Realtime Database rule that allows writes only if the 'score' field is an integer from 0 to 100 inclusive. Which rule condition achieves this?

A newData.exists() && newData.score >= 0 && newData.score <= 100

B newData.hasChild('score') && newData.child('score').isNumber() && newData.child('score').val() >= 0 && newData.child('score').val() <= 100

C newData.hasChild('score') && typeof newData.score == 'number' && newData.score >= 0 && newData.score <= 100

D newData.child('score').isInteger() && newData.child('score').val() > 0 && newData.child('score').val() < 100

💡 Hint

Use Firebase's newData.child('field').isNumber() and val() methods.

Option B correctly checks that 'score' exists, is a number, and is between 0 and 100 inclusive. Other options either use invalid syntax or wrong range checks.

❓ security

advanced

What is the risk of using 'allow read, write: if true;' in Firebase rules?

What security risk arises if you set Firebase Realtime Database rules to allow read, write: if true;?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/{document=**} {
    allow read, write: if true;
  }
}

A Only authenticated users can read and write data.

B No one can read or write data, causing app failures.

C Anyone can read and write all data without restriction, risking data leaks and unauthorized changes.

D Data is encrypted automatically, so no risk exists.

💡 Hint

Consider what 'if true' means for access control.

Setting rules to 'if true' means no restrictions. Anyone on the internet can read or write any data, which is a major security risk.

❓ Architecture

expert

How to design Firebase rules to allow users to edit only their own profile data?

You have a Firebase Realtime Database /users where each child key is a user's UID. Which rule correctly allows users to read and write only their own data?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/ {
    match /users/{userId} {
      allow read, write: if auth != null && auth.uid == userId;
    }
  }
}

A allow read, write: if auth != null && auth.uid == userId;

B allow read, write: if auth != null;

C allow read, write: if userId == 'admin';

D allow read, write: if true;

💡 Hint

Match the authenticated user ID with the document ID.

Option A restricts access so users can only read and write their own data by comparing auth.uid with the path variable userId. Other options are too open or incorrect.

Practice

1. What is the main purpose of Firebase data validation rules?

easy

A. To ensure data is correct and secure before saving

B. To speed up database queries

C. To create user interfaces automatically

D. To backup data to another server

Solution

1. Step 1: Understand what data validation means

   Data validation checks if data meets certain conditions before saving.

2. Step 2: Identify the role of Firebase rules

   Firebase rules check data type, format, and permissions to keep data safe and clean.

3. Final Answer:

   To ensure data is correct and secure before saving -> Option A

4. Quick Check:

   Data validation = correctness and security [OK]

Hint: Validation means checking data before saving [OK]

Common Mistakes:

• Thinking rules speed up queries
• Confusing validation with UI creation
• Assuming rules backup data

2. Which of the following is the correct syntax to allow only string data for a field name in Firebase rules?

easy

A. "name": { ".validate": "newData.isString()" }

B. "name": { ".validate": "newData.isNumber()" }

C. "name": { ".validate": "newData.exists()" }

D. "name": { ".validate": "newData.val() > 0" }

Solution

1. Step 1: Identify the method to check string type

   Firebase uses newData.isString() to check if data is a string.

2. Step 2: Match the syntax with the correct method

   "name": { ".validate": "newData.isString()" } uses newData.isString(), which is correct for string validation.

3. Final Answer:

   "name": { ".validate": "newData.isString()" } -> Option A

4. Quick Check:

   Check string type = newData.isString() [OK]

Hint: Use newData.isString() to validate strings [OK]

Common Mistakes:

• Using isNumber() for strings
• Using exists() which only checks presence
• Using val() > 0 which is for numbers

3. Given this Firebase rule snippet:

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".validate": "newData.hasChildren(['name', 'age']) && newData.child('age').isNumber() && newData.child('age').val() >= 18"
      }
    }
  }
}

What happens if a user tries to write data with age set to 16?

medium

A. Write is denied because name is missing

B. Write is allowed because age is a number

C. Write is denied because age is less than 18

D. Write is allowed regardless of age

Solution

1. Step 1: Analyze the validation condition for age

   The rule requires age to be a number and at least 18.

2. Step 2: Check the given age value

   The user tries to write age = 16, which is less than 18, so validation fails.

3. Final Answer:

   Write is denied because age is less than 18 -> Option C

4. Quick Check:

   Age must be ≥ 18 = deny if 16 [OK]

Hint: Check numeric conditions carefully in validation [OK]

Common Mistakes:

• Ignoring the minimum age check
• Assuming any number is allowed
• Confusing write and validate rules

4. You wrote this Firebase rule to allow only emails ending with '@example.com':

{
  ".validate": "newData.isString() && newData.val().matches('.*@example.com$')"
}

But users with emails like 'user@exampleacom' are still allowed. What is the error?

medium

A. matches() does not work in Firebase rules

B. The regex pattern is incorrect; it should escape the dot

C. newData.isString() is missing

D. The rule should use newData.exists() instead

Solution

1. Step 1: Review the regex pattern used

   The pattern '.*@example.com$' treats '.' as any character, not a literal dot.

2. Step 2: Correct the regex to escape the dot

   It should be '.*@example\.com$' to match the literal '.com' ending.

3. Final Answer:

   The regex pattern is incorrect; it should escape the dot -> Option B

4. Quick Check:

   Escape dot in regex = \. [OK]

Hint: Escape dots in regex with double backslash \ [OK]

Common Mistakes:

• Not escaping '.' in regex
• Thinking matches() is unsupported
• Confusing isString() with exists()

5. You want to write a Firebase validation rule for a posts node where each post must have a title (string, max 100 chars) and tags (array of strings, max 5 tags). Which rule correctly enforces this?

hard

A. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().every(tag => typeof tag === 'string')" } }

B. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().forEach(tag => typeof tag === 'string')" } }

C. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().every(tag => tag.isString())" } }

D. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5" } }

Solution

1. Step 1: Check the available Firebase validation functions

   Firebase rules do not support JavaScript array methods like every() or typeof inside rules.

2. Step 2: Identify the valid checks

   We can check if tags is an array and its length, but cannot check each tag's type in rules.

3. Final Answer:

   "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5" } } -> Option D

4. Quick Check:

   Use only supported rule functions, no JS methods [OK]

Hint: Firebase rules don't support JS array methods like every() [OK]

Common Mistakes:

• Using JavaScript methods inside rules
• Trying to check each array element's type
• Assuming isArray() checks element types