How to improve firebase real time database rules with anonymous user

Question

I have a simple json tree like this : https://ibb.co/Rgpznd0, and my rules are:

{
  "rules": {
        ".read": "auth.uid !== null",
        ".write": "false",  
  }
}

I only need to read the data from the database, i retrieve the token from the user

const accessToken = await user.getIdToken();

and i do a get request with this url with axios:

https://discover-planets-to-visit-default-rtdb.europe-west1.firebasedatabase.app/${query}.json?auth=${accessToken}

this work, but i get some warning from firebase about security rules

///////////////////////////////

UPDATE

I tried to put the rules like this, in a more secure way :

{
  "rules": {
    "destinations": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "false"
      }
    }
  }
}

I tried changing the url like this:

https://discover-planets-to-visit-default-rtdb.europe-west1.firebasedatabase.app/destinations.json/${uid}?auth=${accessToken}

But now the axios request doesn't work even if i put the uid in the query.

I also tried on postman and the response it's seems the html of the page, I am doing something wrong.

How can i do that? And get a json response?

////////////

UPDATE 2

full url like requested

https://discover-planets-to-visit-default-rtdb.europe-west1.firebasedatabase.app/destinations.json/nQhLc86TWHeHhSP7JSuPAJdBKyk1?auth=${accessToken}

UPDATE 3

I have find a solution to my problem, you can check the answer below

user_19325079 · Answer

I follow this guide: https://medium.com/@skytreasure/easy-way-to-secure-firebase-realtime-database-with-rules-when-you-have-anonymous-sign-in-or-already-e8ff1ddfbfc9

Inside the onAuthStateChanged i set a request to the database with the secure key

 await set(
                ref(
                  db,
                  `/${process.env.NEXT_PUBLIC_FIREBASE_ROUTE}/${user.uid}`
                ),
                true
              )
                .then(() => {
                  //Fullfilled
                })
                .catch((error: Error) => {
                  throw new Error(error.message);
                });

Then i didn't change the other methods to fetch.

https://discover-planets-to-visit-default-rtdb.europe-west1.firebasedatabase.app/${query}.json?auth=${accessToken}

Instead of query i put: 'destination' - 'crew' - 'technology' depends of witch pages do you go.

Now the database is secure, only who have the anonymous id can do the request

How to improve firebase real time database rules with anonymous user

1 Answers