Realtime Database security rules in Firebase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow read access only if the user is authenticated.

Firebase

{
  "rules": {
    ".read": "auth != [1]"
  }
}

Drag options to blanks, or click blank then click option'

Atrue

Bundefined

Cfalse

Dnull

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' or 'false' instead of checking for null.

Using 'undefined' which is not valid in Firebase rules.

The rule auth != null means the user must be signed in to read data.

2fill in blank

medium

Complete the code to allow write access only if the user ID matches the data's owner ID.

Firebase

{
  "rules": {
    "items": {
      "$itemId": {
        ".write": "auth.uid == data.child('[1]').val()"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

AownerId

Bid

Cuid

DuserId

Attempts:

3 left

💡 Hint

Common Mistakes

Using auth.uid on the right side instead of the left.

Using incorrect field names like 'userId' or 'id'.

The data should have an ownerId field that matches the authenticated user's ID to allow write access.

3fill in blank

hard

Fix the error in the rule to allow read access only if the user is authenticated and the data exists.

Firebase

{
  "rules": {
    "messages": {
      "$msgId": {
        ".read": "auth != null && data.exists() && data.child('[1]').val() == auth.uid"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aowner

Buser

CownerId

Duid

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'owner' or 'user' which may not exist in the data.

Using 'uid' which is the auth property, not a data field.

The field ownerId should be checked to match auth.uid for secure access.

4fill in blank

hard

Fill both blanks to allow users to write only if they are authenticated and the new data contains a 'text' field.

Firebase

{
  "rules": {
    "posts": {
      "$postId": {
        ".write": "[1] != null && newData.hasChild([2])"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

B"text"

C"content"

DnewData

Attempts:

3 left

💡 Hint

Common Mistakes

Using newData.hasChild('content') instead of 'text'.

Checking data instead of newData.

Check that auth is not null to confirm authentication, and that the new data has a text field.

5fill in blank

hard

Fill all three blanks to allow read access only if the user is authenticated, the data exists, and the user's email is verified.

Firebase

{
  "rules": {
    "users": {
      "$userId": {
        ".read": "[1] != null && data.exists() && auth.token.[2] == true && $userId == auth.[3]"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

Bemail_verified

Cuid

Duser_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using auth.token.emailVerified instead of email_verified.

Using auth.user_id instead of auth.uid.

The rule checks that the user is signed in (auth != null), the data exists, the user's email is verified (auth.token.email_verified == true), and the user ID matches ($userId == auth.uid).

Practice

1. What is the main purpose of Firebase Realtime Database security rules?

easy

A. To control who can read or write data in the database

B. To speed up database queries

C. To backup the database automatically

D. To create database indexes

Solution

1. Step 1: Understand the role of security rules

   Security rules are designed to protect data by controlling access permissions.

2. Step 2: Identify the correct purpose

   They do not affect speed, backups, or indexing but focus on access control.

3. Final Answer:

   To control who can read or write data in the database -> Option A

4. Quick Check:

   Access control = To control who can read or write data [OK]

Hint: Security rules control access, not speed or backups [OK]

Common Mistakes:

• Confusing security rules with database performance features
• Thinking rules create backups automatically
• Assuming rules manage indexing

2. Which of the following is the correct syntax to allow read access only to authenticated users in Firebase Realtime Database rules?

easy

A. "read": "user != null"

B. "read": "auth != null"

C. "read": "auth == null"

D. "read": "auth === true"

Solution

1. Step 1: Recall the correct auth check syntax

   Firebase uses auth != null to check if a user is signed in.

2. Step 2: Compare options

   "read": "auth != null" uses the correct syntax. Options A and B use wrong variables or conditions. "read": "auth === true" uses invalid comparison.

3. Final Answer:

   "read": "auth != null" -> Option B

4. Quick Check:

   Authenticated check = auth != null [OK]

Hint: Use auth != null to check signed-in users [OK]

Common Mistakes:

• Using 'user' instead of 'auth'
• Checking auth == null instead of auth != null
• Using triple equals (===) which is invalid in rules

3. Given the following rule snippet, what will happen if a user tries to write data to /messages when they are not authenticated?

{
  "rules": {
    "messages": {
      ".write": "auth != null"
    }
  }
}

medium

A. The write will be allowed only if the user is authenticated

B. The write will be allowed for all users

C. The write will be denied for all users

D. The write will cause a syntax error

Solution

1. Step 1: Analyze the write condition

   The rule states .write": "auth != null", meaning only authenticated users can write.

2. Step 2: Consider unauthenticated user case

   If the user is not authenticated, auth == null, so write is denied.

3. Final Answer:

   The write will be allowed only if the user is authenticated -> Option A

4. Quick Check:

   auth != null allows writes only for signed-in users [OK]

Hint: auth != null means only signed-in users can write [OK]

Common Mistakes:

• Thinking unauthenticated users can write
• Confusing read and write rules
• Assuming syntax error without checking code

4. Identify the error in this Firebase Realtime Database rule snippet:

{
  "rules": {
    "users": {
      ".read": "auth != null",
      ".write": "auth.id == auth.uid"
    }
  }
}

medium

A. The write rule should use 'auth.uid != null'

B. The read rule should be 'auth == null' to allow access

C. The rules object is missing a closing brace

D. The write rule uses 'auth.id' which is incorrect

Solution

1. Step 1: Check the write rule syntax

   The write rule uses auth.id, but the correct property is auth.uid.

2. Step 2: Verify other parts

   The read rule is correct to allow authenticated users. The braces are balanced. The write rule should compare auth.uid.

3. Final Answer:

   The write rule uses 'auth.id' which is incorrect -> Option D

4. Quick Check:

   Use auth.uid, not auth.id [OK]

Hint: Use auth.uid for user ID, not auth.id [OK]

Common Mistakes:

• Using wrong property name 'auth.id'
• Changing read rule incorrectly
• Assuming syntax error due to braces

5. You want to allow users to read and write only their own profile data stored under /users/{userId}. Which rule correctly enforces this?

hard

A. {
"rules": {
"users": {
".read": "auth.uid == $userId",
".write": "auth.uid == $userId"
}
}
}

B. {
"rules": {
"users": {
"$userId": {
".read": "auth != null",
".write": "auth != null"
}
}
}
}

C. {
"rules": {
"users": {
"$userId": {
".read": "auth != null && auth.uid == $userId",
".write": "auth != null && auth.uid == $userId"
}
}
}
}

D. {
"rules": {
"users": {
"$userId": {
".read": "true",
".write": "true"
}
}
}
}

Solution

1. Step 1: Understand the requirement

   Users should only access their own data under /users/{userId}.

2. Step 2: Check each option

   { "rules": { "users": { "$userId": { ".read": "auth != null && auth.uid == $userId", ".write": "auth != null && auth.uid == $userId" } } } } correctly checks that the authenticated user's ID matches the path variable $userId for both read and write. { "rules": { "users": { "$userId": { ".read": "auth != null", ".write": "auth != null" } } } } allows any authenticated user to access all profiles. { "rules": { "users": { ".read": "auth.uid == $userId", ".write": "auth.uid == $userId" } } } uses $userId outside its scope. { "rules": { "users": { "$userId": { ".read": "true", ".write": "true" } } } } allows everyone access.

3. Final Answer:

   { "rules": { "users": { "$userId": { ".read": "auth != null && auth.uid == $userId", ".write": "auth != null && auth.uid == $userId" } } } } -> Option C

4. Quick Check:

   auth.uid == $userId restricts access to own data [OK]

Hint: Match auth.uid with $userId in path for user-specific access [OK]

Common Mistakes:

• Allowing all authenticated users access to all profiles
• Using variables outside their scope
• Setting rules to true allowing public access