Why security rules protect data in Firebase - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow read access only if the user is authenticated.

Firebase

allow read: if request.auth [1] null;

Drag options to blanks, or click blank then click option'

A>

B==

C!=

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of '!=' causes unauthenticated users to have access.

Using '<' or '>' operators here does not make sense.

The rule checks that the user is signed in by verifying request.auth != null. This means only authenticated users can read data.

2fill in blank

medium

Complete the code to allow write access only if the user's ID matches the data owner ID.

Firebase

allow write: if request.auth.uid [1] resource.data.ownerId;

Drag options to blanks, or click blank then click option'

A==

B!=

C<=

D>

Attempts:

3 left

💡 Hint

Common Mistakes

Using '!=' allows others to write data they don't own.

Using comparison operators like '<=' or '>' is incorrect here.

This rule allows writes only if the signed-in user's ID matches the owner ID stored in the data, ensuring only owners can modify their data.

3fill in blank

hard

Fix the error in the rule that denies all access.

Firebase

allow read, write: if [1];

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cnull

Drequest.auth != null

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' allows all access.

Using 'null' causes errors.

Using 'request.auth != null' allows access only to authenticated users.

Using false denies all access, which is the intended behavior here.

4fill in blank

hard

Fill both blanks to allow read access only if the user is authenticated and the document is not marked private.

Firebase

allow read: if request.auth [1] null && resource.data.private [2] false;

Drag options to blanks, or click blank then click option'

A!=

B==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of '!=' for the auth check.

Using '!=' instead of '==' for the private field check.

The rule checks that the user is signed in (request.auth != null) and that the document's private field is false, meaning it is public.

5fill in blank

hard

Fill all three blanks to allow write access only if the user is authenticated, owns the data, and the new data has a valid status.

Firebase

allow write: if request.auth [1] null && request.auth.uid [2] resource.data.ownerId && request.resource.data.status [3] ['active', 'pending'];

Drag options to blanks, or click blank then click option'

A!=

B==

Cin

Dnot-in

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of '!=' for auth check.

Using '!=' instead of '==' for owner check.

Using 'not-in' instead of 'in' for status check.

This rule ensures the user is signed in (!= null), owns the data (== ownerId), and the new status is one of the allowed values (in ['active', 'pending']).