Data validation rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a Firebase Realtime Database rule denies a write?

You have a Firebase Realtime Database rule that denies write access to a path. What is the result when a client tries to write data to that path?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/ {
    match /users/{userId} {
      allow write: if false;
    }
  }
}

A The write is accepted and data is saved regardless of the rule.

B The write is accepted but data is not saved.

C The write is queued and retried later automatically.

D The write is rejected and the client receives a permission denied error.

💡 Hint

Think about what happens when rules explicitly deny access.

If a rule denies write access, Firebase rejects the write immediately and returns a permission denied error to the client. The data is not saved.

🧠 Conceptual

intermediate

Which Firebase Realtime Database rule condition checks if a user is authenticated?

In Firebase Realtime Database rules, which condition correctly checks if the user is signed in?

A auth != null

B user != null

C request.auth == true

D auth.isSignedIn == true

💡 Hint

Firebase uses a special variable to represent authentication info.

The variable auth is null if the user is not signed in. Checking auth != null confirms the user is authenticated.

❓ Configuration

advanced

Which rule correctly validates that a 'score' field is an integer between 0 and 100?

You want to write a Firebase Realtime Database rule that allows writes only if the 'score' field is an integer from 0 to 100 inclusive. Which rule condition achieves this?

A newData.exists() && newData.score >= 0 && newData.score <= 100

B newData.hasChild('score') && newData.child('score').isNumber() && newData.child('score').val() >= 0 && newData.child('score').val() <= 100

C newData.hasChild('score') && typeof newData.score == 'number' && newData.score >= 0 && newData.score <= 100

D newData.child('score').isInteger() && newData.child('score').val() > 0 && newData.child('score').val() < 100

💡 Hint

Use Firebase's newData.child('field').isNumber() and val() methods.

Option B correctly checks that 'score' exists, is a number, and is between 0 and 100 inclusive. Other options either use invalid syntax or wrong range checks.

❓ security

advanced

What is the risk of using 'allow read, write: if true;' in Firebase rules?

What security risk arises if you set Firebase Realtime Database rules to allow read, write: if true;?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/{document=**} {
    allow read, write: if true;
  }
}

A Only authenticated users can read and write data.

B No one can read or write data, causing app failures.

C Anyone can read and write all data without restriction, risking data leaks and unauthorized changes.

D Data is encrypted automatically, so no risk exists.

💡 Hint

Consider what 'if true' means for access control.

Setting rules to 'if true' means no restrictions. Anyone on the internet can read or write any data, which is a major security risk.

❓ Architecture

expert

How to design Firebase rules to allow users to edit only their own profile data?

You have a Firebase Realtime Database /users where each child key is a user's UID. Which rule correctly allows users to read and write only their own data?

Firebase

rules_version = '2';
service firebase.database {
  match /{database}/ {
    match /users/{userId} {
      allow read, write: if auth != null && auth.uid == userId;
    }
  }
}

A allow read, write: if auth != null && auth.uid == userId;

B allow read, write: if auth != null;

C allow read, write: if userId == 'admin';

D allow read, write: if true;

💡 Hint

Match the authenticated user ID with the document ID.

Option A restricts access so users can only read and write their own data by comparing auth.uid with the path variable userId. Other options are too open or incorrect.