时间戳

首页 > 解决方案 > Firebase says that my rules are insecure, why?

swift - Firebase says that my rules are insecure, why?

问题描述

I have received an email from Firebase advising me that my security rules are insecure citing: Any user can read/write to your database.

How can this be, I have specified .read and .write rules below. What am I missing? any help would be much appreciated.

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null",
      "venues-location": {
        ".indexOn": "g"
    },
      "users-compliments": {
        "$uid":{
          "$uid":{
            ".indexOn": ".value"
          }
        }
    },
      "users-invites": {
        "$uid":{
          "$uid":{
            ".indexOn": ".value"
          }
        }
    },
    "users-location": {
        ".indexOn": "g"
    }
  }
}

标签： swiftfirebasefirebase-realtime-databasefirebase-security

解决方案

".read": "auth != null",

".write": "auth != null",

以上这些规则是默认规则。根据 firebase文档，它们允许对您的应用程序的经过身份验证的用户进行完全读写访问。如果您希望数据对您的应用程序的所有用户开放，但又不希望它向全世界开放，它们会很有用

在启动应用程序之前正确配置这些规则至关重要，以确保您的用户只能访问他们应该访问的数据。

{
  "rules": {
    "foo": {
      ".read": true,
      ".write": false
    }
  }
}

下面是一个规则示例，该规则将经过身份验证的用户的写入权限授予 /users//，其中是通过 Firebase 身份验证获得的用户 ID。

{
  "rules": {
    "users": {
      "$uid": {
        ".write": "$uid === auth.uid"
      }
    }
  }
}

推荐阅读