การควบคุมการเข้าถึงตามผู้ใช้

Welcome to this lesson! In secure applications, it's crucial to control who can access what data. This is known as User-Based Access Control.

Firebase Realtime Database Security Rules allow you to define precise permissions based on the user who is currently logged in.

Inside your security rules, Firebase provides a special auth variable. This variable contains information about the currently authenticated user.

• auth.uid: The unique ID of the logged-in user.
• auth.token: An object containing custom claims and other token details (e.g., email).

If no user is logged in, auth will be null.

The simplest form of user-based access is to ensure only authenticated users can read or write any data.

You can achieve this by checking if the auth variable is not null.

Often, you want users to only read data that belongs to them. Imagine a /users node where each user has a sub-node with their UID.

We can use a wildcard variable ($uid) in the path to match the current user's ID.

Similarly, you can restrict write access so users can only modify their own data. This prevents one user from changing another's profile.

The rule is very similar to the read rule, just applied to .write.

Let's combine the read and write rules. This common pattern allows users full control over their own specific data node, often used for user profiles.

Here, $userId is a placeholder for an actual user's UID.

Consider a 'posts' section where anyone can read posts, but only the creator can edit or delete their own post.

We assume each post object has an ownerId field. We use data.ownerId to refer to the existing owner ID in the database.

Beyond just who can write, you can also validate what data they write. For instance, ensuring that when a user creates an item, they correctly set themselves as the owner.

The newData variable refers to the data being written.

For more complex access, you can define roles like 'admin' or 'moderator'. These roles are often stored as custom claims in the user's authentication token.

You can then check for these roles in your rules using auth.token.

Consider the following Realtime Database Security Rules:

If user "user123" is authenticated and tries to read a message where data.senderId is "user456", will they succeed?

You've learned how to implement powerful user-based access control in Firebase Realtime Database Security Rules!

• The auth variable provides current user details.
• You can restrict access to authenticated users (auth != null).
• Users can be granted read/write access to their own specific data using auth.uid == $uid.
• You can validate incoming data using newData and auth.uid.
• Roles can be used to grant access to specific user groups.

Next, explore how to validate the data itself!