How can I let my Firebase Security Rules allow Authenticated Access to my Realtime Databas when I get "PERMISSION DENIED"

Mister SirCode

I found this question: Firebase Permission Denied which mentions using this JSON code:

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

It only allows access to Read or Write by authenticated users. This would work perfectly for me.

The only issue is that this answer is outdated. They dont use JSON anymore as far as I know.

Currently my rules look like this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

How can I allow only Read and Write access to users with the "API Key" which I have provided and loaded in my app like in the old question?

Edit, I now know that Firebase Realtime Database uses JSON Rules and Firebase Firestore uses the actual Firebase Security Rules Language.

So after I realized this, I set all my rules to auth != null.

In realtime database rules:

{
  "rules": {
    "users": {
        ".read": "auth != null",
        ".write": "auth != null"
    }
  }
}

And also Cloud Storage rules just in case:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

Yet after all of this... Im still getting these errors:enter image description here

I dont get what Im doing wrong, Im directly sending in the API key correctly, I logged it just to test it, all my references are correct...

I DONT GET IT....

EDIT: Code

const firebase = require('firebase');
var config = {
    apiKey: "(Key removed... for obvious reasons)",
    authDomain: "discord-trust.firebaseapp.com",
    databaseURL: "https://discord-trust.firebaseio.com",
    storageBucket: "discord-trust.appspot.com"
};
firebase.initializeApp(config);

... Lots of code between these two ...

case `testWriteReputation`: {
                    if (msg.author.bot) return;
                    if (msg.author.id === bot.user.id) return;
                    firebase.database().ref(`BasicUserData/${msg.author.id}`).set({
                        lastLoggedUsername: msg.author.tag,
                        lastLoggedAvatar: msg.author.avatar,
                        lastLoggedDiscriminator: msg.author.discriminator,
                        userAccountCreated: msg.author.createdAt,
                        userIdentifier: msg.author.id
                    });
                    break;
                }

Entire javascript file can be found here, again, with the api key removed: https://hatebin.com/egchvudbew

Renaud Tarnec

As explained in the doc, if you want to use the auth variable in your Realtime Database Security rules (allowing you to control data access on a per-user basis), you need to use Firebase Authentication.

Once a user authenticates, the auth variable in your Realtime Database Rules rules will be populated with the user's information. This information includes their unique identifier (uid) as well as linked account data, such as a Facebook id or an email address, and other info.

Have a look at this doc for more info on how to start with Authentication.


Note that the Realtime Database and Firestore are two totally different Firebase services. They don't share the same security rules syntax.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

How can I make the security rules of my Firebase Realtime Database read cookies?

I can authenticate to Github using SSH but I get a permission denied when trying to push to my repo

Can i access the firebase realtime database security rules via REST?

Why don't my Firebase Firestore rules allow access when I use a document path?

Firebase permission denied with security rules

Firebase Storage security rules: After specifying "allow read: if request.auth != null" I can still access my files using the download link provided

How can I fix "[Errno 13] Permission denied: '_cmp.pyi'" in my Python nix flake?

How can I remov permission denied for my app in the Facebook developers site?

How do I overcome my permission denied error when running with sudo?

Firebase Security Rules with wildcards (Permission denied even though access is granted)

Can someone please explain to me why we need Firebase security rules when I can literally write rules in my client code?

Firebase read permission denied when using auth security rules

firebase database permission denied even if my rules looks right

How can i get one item from Room databas?

How can I structure Firebase Realtime Database Rules to allow sending of "invite" URLs to non-users to allow access to protected user-data structures?

I suddenly get a Permission Denied (the contents of .git/objects files) error when trying to copy my repository via scp

Firestore Security Rules: PERMISSION DENIED when Batching

How can I allow someone to access my VM?

Why I can't connect through SSH to my EC2 instance? Permission denied

Why am I getting Permission Denied when trying to push a Sqlite file to my rooted Android device?

Why am I getting "permission denied" when connecting to my NFS share?

How can I populate my RecyclerView from multiple nodes of my Firebase Realtime Database?

How to access my data field in Firebase Security Rules

How can I ban a User in Firebase realtime Database using the rules?

Permission Denied when i try to get access to /bin/sh/... in apache kafka in docker

Issue with my Firebase realtime data base security rules

I changed my Firebase rules to all authenticated users.. What I need to change in requests (Flutter)

How can I set Rules in Firebase so that only my app can write on my database firestore?

How can I post my data without generating firebase id on firebase realtime database?