Acces Firebase database securely in Android

user_1288005 0
Viewed 63

I am using Relatime database from firebase to read few flags and do some actions in android app. I used to get mail of insecure database read and write rules so I changed to following:

   {
      "rules": {
      ".read": "true",
      ".write": "false"
     }
 }

And now, I only get mail about insecure read.

  [Firebase] Your Realtime Database 'abc-xyz' has insecure rules
   We've detected the following issue(s) with your security rules:
         any user can read your entire database

But if I change read to false then I am unable to read any value changes in real time. Can someone please help me understand how do I secure both read and write but also able to keep reading values from app?

PS: I don't use Firebase auth in my app as of now.

firebase-security firebase-realtime-database firebase
1 Answers

Firebase Auth is a cool thing, if you don't want your user to log into the authorization provider account, you can use an anonymous account which gives you a unique user ID of your app, etc. Then you can write rules like:

"rules": {
      ".read": "auth != null",
      ".write": "auth != null"
     }

If you don't store user data, you probably don't need any authorization. You can still restrict reading and writing of users by adding some area when read / write is available. E.g:

"rules": {

"PublicData":{
  "SomePublicChild":{
    "ChildProperty1": { ".validate":true },
    "ChildProperty2": { ".validate":true },
    "$other": {".validate":false },
  },
  ".write":true,
  ".read":true,
  ".validate":"newData.hasChild(SomePublicChild)"
},
"PrivateData":{
  ".write":false,
  ".read":false,
}}

These rules will allow anyone to write / read to the PublicData node and to anyone else to write / read the PrivateData node. The rules will also protect the structure of your public data, they only allow writing to the PublicData object with the ChildProperty1 or ChildProperty2 properties, and will block writes with any other property key.

It's not big thing but you won't recive more mail about insecure rules.

user_133846930
Related