Realtime Database security rules in Firebase - Step-by-Step Execution

Process Flow - Realtime Database security rules

Client Request

↓

Check Authentication?

No→Deny Access

Yes↓

Evaluate Security Rules

↓

Allow or Deny Based on Rules

↓

Database Read/Write Operation

When a client requests data, Firebase checks if they are authenticated, then evaluates security rules to allow or deny access.

Execution Sample

Firebase

{
  "rules": {
    "messages": {
      "$messageId": {
        ".read": "auth != null",
        ".write": "auth.uid === newData.child(\"userId\").val()"
      }
    }
  }
}

This rule allows reading messages only if the user is logged in, and writing only if the user owns the message.

Process Table

Step	Request Type	Authentication Present?	Rule Evaluated	Access Result
1	Read /messages/123	Yes	".read": "auth != null"	Allowed
2	Write /messages/123	Yes	".write": "auth.uid === newData.child(\"userId\").val() (uid=abc, userId=abc)"	Allowed
3	Write /messages/123	Yes	".write": "auth.uid === newData.child(\"userId\").val() (uid=abc, userId=xyz)"	Denied
4	Read /messages/123	No	".read": "auth != null"	Denied
5	Write /messages/123	No	".write": "auth.uid === newData.child(\"userId\").val()"	Denied

💡 Access is denied if authentication is missing or rules conditions are not met.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5
auth	null	present (uid=abc)	present (uid=abc)	present (uid=abc)	null	null
newData.child("userId").val()	unknown	abc	abc	xyz	abc	abc
access	none	allowed	allowed	denied	denied	denied

Key Moments - 2 Insights

Why is access denied when the user is not authenticated even for reading?

Because the rule '.read: "auth != null"' requires the user to be logged in. See execution_table row 4 where authentication is null and access is denied.

Why does writing fail when the authenticated user ID does not match the message's userId?

The write rule checks if 'auth.uid === newData.child("userId").val()'. If they differ, access is denied as shown in execution_table row 3.

Visual Quiz - 3 Questions

Look at the execution table, what is the access result at step 2 when the user is authenticated and owns the message?

A Pending

B Denied

C Allowed

D Error

💡 Hint

Check execution_table row 2 under 'Access Result'

At which step does the condition 'auth != null' fail?

A Step 1

B Step 4

C Step 3

D Step 5

💡 Hint

Look for where 'Authentication Present?' is 'No' in execution_table

If the write rule changed to allow any authenticated user to write, how would step 3's access result change?

A It would become Allowed

B It would remain Denied

C It would cause an error

D It would be Pending

💡 Hint

Refer to execution_table row 3 and the write rule condition

Concept Snapshot

Realtime Database security rules control who can read or write data.
Rules check if a user is authenticated and if they meet conditions.
Example: allow read if logged in, allow write if user owns data.
If rules fail, access is denied.
Always test rules to secure your database.

Full Transcript

Realtime Database security rules work by checking each client request. First, Firebase checks if the user is logged in. If not, access is denied. If logged in, it evaluates the rules you set. For example, you can allow reading only if the user is authenticated, and writing only if the user owns the data. Each step in the execution table shows how requests are checked and either allowed or denied based on these rules. This ensures your database stays secure by only letting the right users access or change data.