Firebase User Security Simulation

Question

I'm really scratching my head here, and I've been reading as much as I can on many other cases. I'm new to Firebase, but got some understanding of it. I was wanting to restrict certain records of the database to certain users. So here's my JSON:

  "accounts" : {
    "13asdf313" : {
      "dog" : "bacon",
      "email" : "[email protected]",
      "first" : "luis",
      "last" : "xxxx"
    },
    "HlELrrGDbiMKgxxxx" : {
      "name" : "Luis"
    },
    "anthony" : {
      "email" : "[email protected]",
      "last" : "xxxx",
      "name" : "anthony"
    },
    "jpSq6UzX0mcAvExxxx" : {
      "name" : "anthony"
    }
  }

Here are the rules set up based on what I've been reading:

{
  "rules": {
    "accounts":{

      "$uid":{
        ".read": "auth.uid == $uid",
        ".write": "auth.uid == $uid"
      }
    },

  }


}

In the simulator, I used the bottom condition (I even put /accounts in the location field). I used the UID: HlELrrGDbiMKgxxxx, copied straight from Firebase account list.

This is always coming up as failed

What am I doing wrong?

Answer 1

You have to insert accounts/HlELrrGDbiMKgxxxx into the Location field.

Otherwise you are trying to access the whole database (standard location is root, which covers the whole database). Your rule is just set for the child accounts/$uid and to access it the user id from authentication and the child location in the database must match.