[Vuejs]-Vue.js Firebase RealTime DB Rules – set rules for property modified by app function

by

0👍

To give someone with the admin role read access to the whole database, use these rules:

{
  "rules": {
    ".read": "root.child('users').child(auth.uid).child('isAdmin').val() === true"
  }
}

This read rule replaces what you currently have, since right now all signed in users can read the entire database.

To then allow each user to read/write their own info, modify the above to:

{
  "rules": {
    ".read": "root.child('users').child(auth.uid).child('isAdmin').val() === true",
    "users": {
      "$uid": {
        ".read": "auth.uid === $uid",
        ".write": "auth.uid === $uid"
      }
    }
  }
}

I highly recommend checking out the Firebase documentation on security rules, specifically the section on securing user data (which covers step two I showed above), as well as the great video explaining security rules.

Leave a comment