What is the most secured security rule to enable only a user of my app to change a value from false to true?

Admin 1
Viewed 48

I integrated Firebase into my app. The user details in my database are stored as users -> uid -> key: name, value: name of the user, key: dept, value: department of the user, key: done, value: false

Now if a user does a particular activity (or work) in his/her app, the value of the key done will be changed to true. I don't want any malicious user to create an account and change the value of the done key to true. What will be the most secured security rule in that case?

firebase-security firebase-authentication firebase-realtime-database firebase android
1 Answers

What you can do is to check if the current authenticated user's ID matches the document he/she tries to update. You can do it in Firebase security rules by adding this:

 match /users/{uid}/{documents=**} {
     allow update: if request.auth != null && request.auth.uid == uid;
 }

request.auth.uid is the uid of the user who sent request to Firebase and uid is the document id. This statement will return true only when the user modifies his/her document.

user_160594120
Related