Read and write permissions in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Firebase Realtime Database: Read Permission Behavior

Consider the following Firebase Realtime Database security rule snippet:

{
  "rules": {
    ".read": "auth != null && auth.uid == 'user123'"
  }
}

What happens when a user with UID 'user456' tries to read data?

A The read request is denied because the UID does not match 'user123'.

B The read request is allowed because the user is authenticated.

C The read request is allowed for all users regardless of UID.

D The read request causes a syntax error in the rules.

💡 Hint

Check the condition that compares the user's UID.

The rule allows read access only if the user is authenticated and their UID equals 'user123'. Since 'user456' does not match, the read is denied.

❓ Configuration

intermediate

Firestore Security Rules: Write Permission Condition

Given this Firestore security rule snippet:

service cloud.firestore {
  match /databases/{database}/documents {
    match /posts/{postId} {
      allow write: if request.auth != null && request.auth.uid == resource.data.ownerId;
    }
  }
}

What is the effect of this rule on write operations?

A Only authenticated users who own the post can write to it.

B Any authenticated user can write to any post.

C Unauthenticated users can write to posts.

D No user can write to posts because the rule is invalid.

💡 Hint

Look at the condition comparing request.auth.uid and resource.data.ownerId.

The rule allows write only if the user is authenticated and their UID matches the ownerId field of the post document, ensuring only owners can write.

❓ Architecture

advanced

Designing Firebase Rules for Multi-Role Access

You want to design Firebase Realtime Database rules where:

• Admins can read and write all data.
• Regular users can only read and write their own data.

Which rule snippet correctly implements this?

A

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

B

{
  "rules": {
    "$uid": {
      ".read": "auth != null && (auth.token.admin == true || auth.uid == $uid)",
      ".write": "auth != null && (auth.token.admin == true || auth.uid == $uid)"
    }
  }
}

C

{
  "rules": {
    "$uid": {
      ".read": "auth != null && auth.uid == $uid",
      ".write": "auth != null && auth.uid == $uid"
    },
    ".read": "auth.token.admin == true",
    ".write": "auth.token.admin == true"
  }
}

D

{
  "rules": {
    "$uid": {
      ".read": "auth.token.admin == true",
      ".write": "auth.token.admin == true"
    }
  }
}

💡 Hint

Consider how to check admin role and user identity in the same condition.

Option B allows read and write if the user is admin or if the user is accessing their own data. Other options either restrict admin access or allow too much access.

❓ security

advanced

Preventing Unauthorized Writes in Firestore

Which Firestore security rule snippet prevents users from changing the 'ownerId' field of a document during an update?

service cloud.firestore {
  match /databases/{database}/documents {
    match /items/{itemId} {
      allow update: if request.auth != null && request.auth.uid == resource.data.ownerId && request.resource.data.ownerId == resource.data.ownerId;
    }
  }
}

A The rule denies all updates because of a syntax error.

B The rule allows any authenticated user to update the document.

C The rule allows updates only if the ownerId is changed.

D The rule allows update only if the user is the owner and does not change the ownerId field.

💡 Hint

Look at the condition comparing request.resource.data.ownerId and resource.data.ownerId.

The rule ensures the user is authenticated and owner, and that the ownerId field remains unchanged during update, preventing unauthorized ownership changes.

✅ Best Practice

expert

Optimizing Firebase Realtime Database Rules for Performance

You have a Firebase Realtime Database with many users. You want to optimize security rules to minimize rule evaluation time while ensuring:

• Users can read and write only their own data.
• Admins can read and write all data.

Which rule structure is best for performance and security?

A

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }
    }
  }
}

B

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

C

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "auth != null && (auth.token.admin == true || auth.uid == $uid)",
        ".write": "auth != null && (auth.token.admin == true || auth.uid == $uid)"
      }
    },
    ".read": "auth.token.admin == true",
    ".write": "auth.token.admin == true"
  }
}

D

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "true",
        ".write": "true"
      }
    }
  }
}

💡 Hint

Consider how to minimize rule checks and allow admin override efficiently.

Option C scopes user data under 'users/$uid' with per-user rules and adds top-level admin rules for all data, optimizing evaluation by limiting checks and allowing admin access.

Practice

1. What is the main purpose of Firebase read and write permissions?

easy

A. To control who can view or change data in the database

B. To speed up data retrieval from the database

C. To backup data automatically

D. To create new database tables

Solution

1. Step 1: Understand permission roles

   Read and write permissions define who can access or modify data.

2. Step 2: Identify the purpose

   They protect data by controlling access, not by speeding up or backing up data.

3. Final Answer:

   To control who can view or change data in the database -> Option A

4. Quick Check:

   Permissions control access = A [OK]

Hint: Permissions control access, not speed or backups [OK]

Common Mistakes:

• Confusing permissions with performance features
• Thinking permissions create database structure
• Assuming permissions handle backups

2. Which Firebase rule syntax correctly allows only authenticated users to read data?

easy

A. "read": "true"

B. "read": "auth != null"

C. "read": "auth == null"

D. "read": "false"

Solution

1. Step 1: Understand auth variable

   In Firebase rules, auth != null means user is logged in.

2. Step 2: Match condition to requirement

   Allowing read only if auth != null means only authenticated users can read.

3. Final Answer:

   "read": "auth != null" -> Option B

4. Quick Check:

   auth != null means logged in = C [OK]

Hint: auth != null means user is logged in [OK]

Common Mistakes:

• Using auth == null which allows unauthenticated users
• Setting read to true allows everyone
• Setting read to false blocks all reads

3. Given this Firebase rule snippet:

{
  "rules": {
    "messages": {
      ".read": "auth != null",
      ".write": "auth.uid == data.child('owner').val()"
    }
  }
}

What happens if a logged-in user tries to write a message where they are not the owner?

medium

A. Write is denied because user is not the owner

B. Write is allowed because user is logged in

C. Write is allowed for all users

D. Write causes a syntax error

Solution

1. Step 1: Analyze write condition

   Write is allowed only if auth.uid equals the owner field in data.

2. Step 2: Check user ownership

   If user is not owner, condition fails, so write is denied.

3. Final Answer:

   Write is denied because user is not the owner -> Option A

4. Quick Check:

   Write allowed only if user owns data = D [OK]

Hint: Write allowed only if auth.uid matches owner [OK]

Common Mistakes:

• Assuming logged-in users can write anywhere
• Confusing read and write rules
• Ignoring the owner check in write condition

4. Identify the error in this Firebase rule snippet:

{
  "rules": {
    "posts": {
      ".read": "auth != null",
      ".write": "auth.uid = data.child('author').val()"
    }
  }
}

medium

A. data.child() cannot be used in rules

B. Missing quotes around auth.uid

C. auth != null is invalid syntax

D. Using single equals (=) instead of double equals (==) in write condition

Solution

1. Step 1: Check write condition syntax

   Single equals (=) is assignment, not comparison in Firebase rules.

2. Step 2: Correct comparison operator

   Use double equals (==) to compare auth.uid and data.child('author').val().

3. Final Answer:

   Using single equals (=) instead of double equals (==) in write condition -> Option D

4. Quick Check:

   Use == for comparison, not = [OK]

Hint: Use == for comparison, not = [OK]

Common Mistakes:

• Confusing assignment (=) with comparison (==)
• Thinking auth.uid needs quotes
• Believing data.child() is invalid in rules

5. You want to allow users to read all their own profile data but prevent others from reading it. Which Firebase rule correctly enforces this?

{
  "rules": {
    "profiles": {
      "$userId": {
        ".read": "?",
        ".write": "auth.uid == $userId"
      }
    }
  }
}

hard

A. "auth != null"

B. "true"

C. "auth.uid == $userId"

D. "auth.uid != $userId"

Solution

1. Step 1: Understand read condition need

   Users should read only their own profile, so read must check auth.uid equals $userId.

2. Step 2: Match read condition to requirement

   Setting ".read": "auth.uid == $userId" restricts read access to owner only.

3. Final Answer:

   "auth.uid == $userId" -> Option C

4. Quick Check:

   Read allowed only if user matches profile ID = B [OK]

Hint: Read only if auth.uid equals profile ID [OK]

Common Mistakes:

• Using auth != null allows all logged-in users to read
• Setting read to true allows everyone
• Using auth.uid != $userId allows others to read