How safe is auth !== null? Firebase

user_3192218 0
Viewed 14786

I've been using Firebase for quite some time, but I only now decided to really look into the security rules.

My question is, how safe is "auth !== null"? Yes, I realize that this means that only an authenticated user can access the data, but how easy is it to become authenticated? Can someone sign up for the app, and then use those credentials to GET request right into my database?

Like I said, I'm new to Security rules, so I'm sorry if this is an obvious question.

Here's my security rules:

{
  "rules": {
    "Users": {
      "$user_id": {
        ".write": "$user_id === auth.uid",  
        ".read" : "auth !== null",
        "shoofers" : {
          ".write" : "auth != null"
        }
      }
    }
  }
}

Thanks!

Neil

firebase-security firebase-authentication firebase security database
3 Answers

The thing i have seen is, when you use 'simulator' from firebase console and fake authentication by giving some random string as uid, firebase doesn't check it and allows access. So auth!=null is not enough because it authenticates even if uid=1.

user_81699960
Related