Realtime Database security rules in Firebase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow read access only if the user is authenticated.

Firebase

{
  "rules": {
    ".read": "auth != [1]"
  }
}

Drag options to blanks, or click blank then click option'

Atrue

Bundefined

Cfalse

Dnull

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' or 'false' instead of checking for null.

Using 'undefined' which is not valid in Firebase rules.

The rule auth != null means the user must be signed in to read data.

2fill in blank

medium

Complete the code to allow write access only if the user ID matches the data's owner ID.

Firebase

{
  "rules": {
    "items": {
      "$itemId": {
        ".write": "auth.uid == data.child('[1]').val()"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

AownerId

Bid

Cuid

DuserId

Attempts:

3 left

💡 Hint

Common Mistakes

Using auth.uid on the right side instead of the left.

Using incorrect field names like 'userId' or 'id'.

The data should have an ownerId field that matches the authenticated user's ID to allow write access.

3fill in blank

hard

Fix the error in the rule to allow read access only if the user is authenticated and the data exists.

Firebase

{
  "rules": {
    "messages": {
      "$msgId": {
        ".read": "auth != null && data.exists() && data.child('[1]').val() == auth.uid"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aowner

Buser

CownerId

Duid

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'owner' or 'user' which may not exist in the data.

Using 'uid' which is the auth property, not a data field.

The field ownerId should be checked to match auth.uid for secure access.

4fill in blank

hard

Fill both blanks to allow users to write only if they are authenticated and the new data contains a 'text' field.

Firebase

{
  "rules": {
    "posts": {
      "$postId": {
        ".write": "[1] != null && newData.hasChild([2])"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

B"text"

C"content"

DnewData

Attempts:

3 left

💡 Hint

Common Mistakes

Using newData.hasChild('content') instead of 'text'.

Checking data instead of newData.

Check that auth is not null to confirm authentication, and that the new data has a text field.

5fill in blank

hard

Fill all three blanks to allow read access only if the user is authenticated, the data exists, and the user's email is verified.

Firebase

{
  "rules": {
    "users": {
      "$userId": {
        ".read": "[1] != null && data.exists() && auth.token.[2] == true && $userId == auth.[3]"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

Bemail_verified

Cuid

Duser_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using auth.token.emailVerified instead of email_verified.

Using auth.user_id instead of auth.uid.

The rule checks that the user is signed in (auth != null), the data exists, the user's email is verified (auth.token.email_verified == true), and the user ID matches ($userId == auth.uid).