0Pricing
Firebase Auth & Realtime Database Apps · Lesson

Role-Based Access for User Data

Combine Firebase Auth roles with Realtime Database rules to grant admins, members, and guests different levels of access to shared and personal data.

Role-Based Access for User Data is a free Firebase Auth & Realtime Database Apps lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Firebase Auth & Realtime Database Apps learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Beyond Owner-Only Access

So far each user reads and writes their own data. Real apps need roles: an admin who moderates content, members who collaborate, and guests with read-only access.

Role-based access control (RBAC) layers permissions on top of authentication.

Where Roles Live

You can store a user's role in two places:

  • A roles node in the database, read inside rules
  • A custom claim on the auth token (set server-side)

Custom claims are faster to check; database roles are easier to change at runtime.

Roles in the Database

A simple model maps each uid to a role string. This data itself must be locked down so users cannot promote themselves.

{
  "roles": {
    "uid_alice": "admin",
    "uid_bob": "member"
  }
}

Checking a Database Role in Rules

Rules can read other parts of the database with root. Here only admins may write to a shared config node.

{
  "rules": {
    "config": {
      ".write": "root.child('roles').child(auth.uid).val() === 'admin'"
    }
  }
}

Custom Claims for Roles

With the Admin SDK you can attach a role to the token itself. This is checked without an extra database read.

await admin.auth().setCustomUserClaims(uid, { role: 'admin' });

Checking Claims in Rules

Custom claims appear under auth.token. The rule becomes simpler and avoids a root lookup.

{
  "rules": {
    "config": {
      ".write": "auth.token.role === 'admin'"
    }
  }
}

Reading the Claim Client-Side

The client can read its own claims to adjust the UI, for example showing an admin panel only to admins.

import { getAuth, getIdTokenResult } from 'firebase/auth';

const res = await getIdTokenResult(getAuth().currentUser);
if (res.claims.role === 'admin') showAdminPanel();

Tiered Read Access

Different roles can have different read scopes. Members read shared docs; guests read only public ones.

{
  "rules": {
    "shared": {
      ".read": "auth.token.role === 'member' || auth.token.role === 'admin'"
    }
  }
}

Protecting the Role Data Itself

Critically, users must not be able to edit their own role. Make the roles node writable only by admins (or only server-side), or self-escalation defeats the whole system.

{
  "rules": {
    "roles": {
      ".write": "auth.token.role === 'admin'"
    }
  }
}

Claim Propagation Delay

After you change a custom claim, the user's existing token still has the old value until it refreshes (about an hour, or on forced refresh). Call getIdToken(true) client-side to pick up new roles immediately.

await getAuth().currentUser.getIdToken(true);

Choosing an Approach

Use custom claims for stable, security-critical roles, and database roles when permissions change often or need to be queried. Many apps combine both.

Quick Check

Test your understanding of role-based access.

Recap

You can now grant tiered access by role.

  • Store roles in the database or as custom claims
  • Check database roles via root, claims via auth.token
  • Give roles different read/write scopes
  • Lock down the role data so users cannot self-promote
  • Refresh tokens to pick up new claims promptly

Frequently asked questions

Is the “Role-Based Access for User Data” lesson free?

Yes — the full text of “Role-Based Access for User Data” is free to read here on the web, and the Firebase Auth & Realtime Database Apps course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Firebase Auth & Realtime Database Apps course, upgrade to CoddyKit PRO.

What will I learn in “Role-Based Access for User Data”?

Combine Firebase Auth roles with Realtime Database rules to grant admins, members, and guests different levels of access to shared and personal data. You practise Firebase Auth & Realtime Database Apps with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Firebase Auth & Realtime Database Apps?

No prior experience is required. Firebase Auth & Realtime Database Apps on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Role-Based Access for User Data” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Firebase Auth & Realtime Database Apps lesson?

Yes. Every Firebase Auth & Realtime Database Apps lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Connecting User Data to Auth
  2. Realtime User Profiles
  3. Collaborative Data Editing
  4. Role-Based Access for User Data
← Back to Firebase Auth & Realtime Database Apps