Read and write permissions in Firebase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow anyone to read data.

Firebase

{
  "rules": {
    ".read": [1]
  }
}

Drag options to blanks, or click blank then click option'

Afalse

Btrue

Cauth != null

Dauth.uid != null

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'false' which denies all reads.

Using 'auth != null' which restricts reads to authenticated users.

Setting .read to true allows anyone to read the data.

2fill in blank

medium

Complete the code to allow only authenticated users to write data.

Firebase

{
  "rules": {
    ".write": [1]
  }
}

Drag options to blanks, or click blank then click option'

Aauth != null

Btrue

Cfalse

Dauth == null

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' which allows anyone to write.

Using 'false' which denies all writes.

Using auth != null ensures only signed-in users can write data.

3fill in blank

hard

Fix the error in the rule to allow authenticated users to read and write.

Firebase

{
  "rules": {
    ".read": [1],
    ".write": [1]
  }
}

Drag options to blanks, or click blank then click option'

Aauth != null

Bfalse

Ctrue

Dauth == null

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'auth == null' which denies authenticated users.

Using different conditions for read and write.

Both .read and .write should be set to auth != null to allow only authenticated users.

4fill in blank

hard

Fill both blanks to allow authenticated users to read, but only users with matching UID to write.

Firebase

{
  "rules": {
    ".read": [1],
    ".write": [2]
  }
}

Drag options to blanks, or click blank then click option'

Aauth != null

Btrue

Cauth.uid == $uid

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing writes for all authenticated users.

Denying reads for authenticated users.

Read is allowed for any authenticated user (auth != null), but write is allowed only if the user's UID matches (auth.uid == $uid).

5fill in blank

hard

Fill all three blanks to allow anyone to read, only authenticated users to write, and only if the data has a 'public' field set to true.

Firebase

{
  "rules": {
    ".read": [1],
    ".write": [2],
    "data": {
      ".validate": "newData.hasChild('public') && newData.child('public').val() == [3]"
    }
  }
}

Drag options to blanks, or click blank then click option'

Atrue

Bauth != null

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting read or write to false.

Using 'false' for the 'public' field check.

Read is open to all (true), write requires authentication (auth != null), and the 'public' field must be true (true).

Practice

1. What is the main purpose of Firebase read and write permissions?

easy

A. To control who can view or change data in the database

B. To speed up data retrieval from the database

C. To backup data automatically

D. To create new database tables

Solution

1. Step 1: Understand permission roles

   Read and write permissions define who can access or modify data.

2. Step 2: Identify the purpose

   They protect data by controlling access, not by speeding up or backing up data.

3. Final Answer:

   To control who can view or change data in the database -> Option A

4. Quick Check:

   Permissions control access = A [OK]

Hint: Permissions control access, not speed or backups [OK]

Common Mistakes:

• Confusing permissions with performance features
• Thinking permissions create database structure
• Assuming permissions handle backups

2. Which Firebase rule syntax correctly allows only authenticated users to read data?

easy

A. "read": "true"

B. "read": "auth != null"

C. "read": "auth == null"

D. "read": "false"

Solution

1. Step 1: Understand auth variable

   In Firebase rules, auth != null means user is logged in.

2. Step 2: Match condition to requirement

   Allowing read only if auth != null means only authenticated users can read.

3. Final Answer:

   "read": "auth != null" -> Option B

4. Quick Check:

   auth != null means logged in = C [OK]

Hint: auth != null means user is logged in [OK]

Common Mistakes:

• Using auth == null which allows unauthenticated users
• Setting read to true allows everyone
• Setting read to false blocks all reads

3. Given this Firebase rule snippet:

{
  "rules": {
    "messages": {
      ".read": "auth != null",
      ".write": "auth.uid == data.child('owner').val()"
    }
  }
}

What happens if a logged-in user tries to write a message where they are not the owner?

medium

A. Write is denied because user is not the owner

B. Write is allowed because user is logged in

C. Write is allowed for all users

D. Write causes a syntax error

Solution

1. Step 1: Analyze write condition

   Write is allowed only if auth.uid equals the owner field in data.

2. Step 2: Check user ownership

   If user is not owner, condition fails, so write is denied.

3. Final Answer:

   Write is denied because user is not the owner -> Option A

4. Quick Check:

   Write allowed only if user owns data = D [OK]

Hint: Write allowed only if auth.uid matches owner [OK]

Common Mistakes:

• Assuming logged-in users can write anywhere
• Confusing read and write rules
• Ignoring the owner check in write condition

4. Identify the error in this Firebase rule snippet:

{
  "rules": {
    "posts": {
      ".read": "auth != null",
      ".write": "auth.uid = data.child('author').val()"
    }
  }
}

medium

A. data.child() cannot be used in rules

B. Missing quotes around auth.uid

C. auth != null is invalid syntax

D. Using single equals (=) instead of double equals (==) in write condition

Solution

1. Step 1: Check write condition syntax

   Single equals (=) is assignment, not comparison in Firebase rules.

2. Step 2: Correct comparison operator

   Use double equals (==) to compare auth.uid and data.child('author').val().

3. Final Answer:

   Using single equals (=) instead of double equals (==) in write condition -> Option D

4. Quick Check:

   Use == for comparison, not = [OK]

Hint: Use == for comparison, not = [OK]

Common Mistakes:

• Confusing assignment (=) with comparison (==)
• Thinking auth.uid needs quotes
• Believing data.child() is invalid in rules

5. You want to allow users to read all their own profile data but prevent others from reading it. Which Firebase rule correctly enforces this?

{
  "rules": {
    "profiles": {
      "$userId": {
        ".read": "?",
        ".write": "auth.uid == $userId"
      }
    }
  }
}

hard

A. "auth != null"

B. "true"

C. "auth.uid == $userId"

D. "auth.uid != $userId"

Solution

1. Step 1: Understand read condition need

   Users should read only their own profile, so read must check auth.uid equals $userId.

2. Step 2: Match read condition to requirement

   Setting ".read": "auth.uid == $userId" restricts read access to owner only.

3. Final Answer:

   "auth.uid == $userId" -> Option C

4. Quick Check:

   Read allowed only if user matches profile ID = B [OK]

Hint: Read only if auth.uid equals profile ID [OK]

Common Mistakes:

• Using auth != null allows all logged-in users to read
• Setting read to true allows everyone
• Using auth.uid != $userId allows others to read