Data validation rules in Firebase - Step-by-Step Execution

Process Flow - Data validation rules

Client sends data write request

↓

Firebase receives request

↓

Check validation rules

↓

Write data

↓

Confirm success

When a client tries to write data, Firebase checks the validation rules. If data is valid, it writes; if not, it rejects.

Execution Sample

Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow write: if request.resource.data.age >= 18;
    }
  }
}

This rule allows writing user data only if the age is 18 or older.

Process Table

Step	Action	Data Sent	Validation Check	Result
1	Client sends write request	{"age": 20}	Check if age >= 18	Valid - allow write
2	Write data to database	{"age": 20}	N/A	Write successful
3	Client sends write request	{"age": 16}	Check if age >= 18	Invalid - reject write
4	Reject write request	{"age": 16}	N/A	Write rejected with error

💡 Execution stops after write is allowed or rejected based on validation.

Status Tracker

Variable	Start	After Step 1	After Step 3	Final
request.resource.data.age	undefined	20	16	N/A
validation result	undefined	true	false	N/A

Key Moments - 2 Insights

Why does the write get rejected when age is 16?

Because the validation rule requires age to be 18 or older, as shown in execution_table step 3 where the check fails.

What happens if the data passes validation?

The data is written to the database successfully, as seen in execution_table step 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the validation result when age is 20?

A No validation performed

B Invalid - reject write

C Valid - allow write

D Write rejected with error

💡 Hint

Check execution_table row 1 under 'Validation Check' and 'Result'

At which step does the write get rejected?

A Step 2

B Step 4

C Step 3

D Step 1

💡 Hint

Look at execution_table rows 3 and 4 for rejection details

If the rule changed to age >= 21, what would happen at step 1 with age 20?

A Write rejected

B No change

C Write allowed

D Error in rule

💡 Hint

Compare the validation condition in execution_sample with the data in execution_table

Concept Snapshot

Firebase Data Validation Rules:
- Define rules to check data before writing
- Use conditions like 'age >= 18'
- If data passes, write allowed
- If data fails, write rejected
- Protects database from bad data

Full Transcript

When a client tries to write data to Firebase, the system checks the data against validation rules. For example, a rule might require the user's age to be 18 or older. If the data meets this rule, Firebase writes it to the database and confirms success. If not, Firebase rejects the write and sends an error. This process ensures only valid data is stored.

Practice

1. What is the main purpose of Firebase data validation rules?

easy

A. To ensure data is correct and secure before saving

B. To speed up database queries

C. To create user interfaces automatically

D. To backup data to another server

Solution

1. Step 1: Understand what data validation means

   Data validation checks if data meets certain conditions before saving.

2. Step 2: Identify the role of Firebase rules

   Firebase rules check data type, format, and permissions to keep data safe and clean.

3. Final Answer:

   To ensure data is correct and secure before saving -> Option A

4. Quick Check:

   Data validation = correctness and security [OK]

Hint: Validation means checking data before saving [OK]

Common Mistakes:

• Thinking rules speed up queries
• Confusing validation with UI creation
• Assuming rules backup data

2. Which of the following is the correct syntax to allow only string data for a field name in Firebase rules?

easy

A. "name": { ".validate": "newData.isString()" }

B. "name": { ".validate": "newData.isNumber()" }

C. "name": { ".validate": "newData.exists()" }

D. "name": { ".validate": "newData.val() > 0" }

Solution

1. Step 1: Identify the method to check string type

   Firebase uses newData.isString() to check if data is a string.

2. Step 2: Match the syntax with the correct method

   "name": { ".validate": "newData.isString()" } uses newData.isString(), which is correct for string validation.

3. Final Answer:

   "name": { ".validate": "newData.isString()" } -> Option A

4. Quick Check:

   Check string type = newData.isString() [OK]

Hint: Use newData.isString() to validate strings [OK]

Common Mistakes:

• Using isNumber() for strings
• Using exists() which only checks presence
• Using val() > 0 which is for numbers

3. Given this Firebase rule snippet:

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid",
        ".validate": "newData.hasChildren(['name', 'age']) && newData.child('age').isNumber() && newData.child('age').val() >= 18"
      }
    }
  }
}

What happens if a user tries to write data with age set to 16?

medium

A. Write is denied because name is missing

B. Write is allowed because age is a number

C. Write is denied because age is less than 18

D. Write is allowed regardless of age

Solution

1. Step 1: Analyze the validation condition for age

   The rule requires age to be a number and at least 18.

2. Step 2: Check the given age value

   The user tries to write age = 16, which is less than 18, so validation fails.

3. Final Answer:

   Write is denied because age is less than 18 -> Option C

4. Quick Check:

   Age must be ≥ 18 = deny if 16 [OK]

Hint: Check numeric conditions carefully in validation [OK]

Common Mistakes:

• Ignoring the minimum age check
• Assuming any number is allowed
• Confusing write and validate rules

4. You wrote this Firebase rule to allow only emails ending with '@example.com':

{
  ".validate": "newData.isString() && newData.val().matches('.*@example.com$')"
}

But users with emails like 'user@exampleacom' are still allowed. What is the error?

medium

A. matches() does not work in Firebase rules

B. The regex pattern is incorrect; it should escape the dot

C. newData.isString() is missing

D. The rule should use newData.exists() instead

Solution

1. Step 1: Review the regex pattern used

   The pattern '.*@example.com$' treats '.' as any character, not a literal dot.

2. Step 2: Correct the regex to escape the dot

   It should be '.*@example\.com$' to match the literal '.com' ending.

3. Final Answer:

   The regex pattern is incorrect; it should escape the dot -> Option B

4. Quick Check:

   Escape dot in regex = \. [OK]

Hint: Escape dots in regex with double backslash \ [OK]

Common Mistakes:

• Not escaping '.' in regex
• Thinking matches() is unsupported
• Confusing isString() with exists()

5. You want to write a Firebase validation rule for a posts node where each post must have a title (string, max 100 chars) and tags (array of strings, max 5 tags). Which rule correctly enforces this?

hard

A. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().every(tag => typeof tag === 'string')" } }

B. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().forEach(tag => typeof tag === 'string')" } }

C. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5 && newData.child('tags').val().every(tag => tag.isString())" } }

D. "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5" } }

Solution

1. Step 1: Check the available Firebase validation functions

   Firebase rules do not support JavaScript array methods like every() or typeof inside rules.

2. Step 2: Identify the valid checks

   We can check if tags is an array and its length, but cannot check each tag's type in rules.

3. Final Answer:

   "posts": { "$postid": { ".validate": "newData.hasChildren(['title', 'tags']) && newData.child('title').isString() && newData.child('title').val().length() <= 100 && newData.child('tags').numChildren() <= 5" } } -> Option D

4. Quick Check:

   Use only supported rule functions, no JS methods [OK]

Hint: Firebase rules don't support JS array methods like every() [OK]

Common Mistakes:

• Using JavaScript methods inside rules
• Trying to check each array element's type
• Assuming isArray() checks element types