测试与调试安全规则
通过模拟请求、使用 Rules Playground、借助模拟器编写自动化测试并阅读拒绝消息，增强对 Realtime Database 规则的信心。
测试与调试安全规则 是 CoddyKit 上的免费 Firebase Auth & Realtime Database Apps 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Firebase Auth & Realtime Database Apps 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Why Test Your Rules
Security Rules are the only thing standing between your data and the open internet. A single mistake can expose private data or block legitimate users.
Testing rules is as important as testing code, and Firebase gives you several tools to do it.
The Rules Playground
The Firebase console includes a Rules Playground where you simulate a single read or write without touching real data.
- Pick read or write
- Set a path and auth state
- See instantly whether it is allowed or denied
Simulating Auth State
In the simulator you can run as an unauthenticated user or supply a fake auth.uid and custom claims. This is how you verify that user-based access control behaves correctly.
Reading a Denial
When a request is denied, the simulator highlights the exact rule that evaluated to false. Use this to pinpoint why a legitimate request is being blocked.
The Local Emulator
For repeatable, automated testing, use the Firebase Local Emulator Suite. It runs the Realtime Database and its rules entirely on your machine, with no cloud costs.
firebase emulators:start --only databaseWriting a Rules Test
The @firebase/rules-unit-testing library lets you assert that operations succeed or fail. This is the gold standard for rule confidence.
import { assertSucceeds, assertFails } from '@firebase/rules-unit-testing';
await assertSucceeds(authedDb.ref('users/alice').set({ name: 'Alice' }));
await assertFails(authedDb.ref('users/bob').set({ name: 'hax' }));Test Both Directions
Good rule tests check both outcomes:
- Authorized users can do allowed actions (no false denials)
- Unauthorized users cannot do forbidden actions (no security holes)
Testing only the happy path hides the dangerous gaps.
Testing Validation Rules
Beyond access, test your .validate rules: confirm that malformed data is rejected and well-formed data is accepted.
await assertFails(db.ref('age').set('not-a-number'));
await assertSucceeds(db.ref('age').set(30));Common Rule Bugs
Watch for these frequent mistakes:
- Rules cascade: a true
.readhigher up overrides children - Forgetting that read and write rules are independent
- Assuming
authis non-null without checking
Debugging with newData
Inside write rules, newData represents what the write would produce and data is the current value. Logging your reasoning about these in test cases clears up many confusing denials.
{
"posts": {
"$id": {
".write": "!data.exists() || data.child('owner').val() === auth.uid"
}
}
}CI Integration
Run your emulator-based rule tests in continuous integration so a risky rule change is caught before it reaches production. This turns security into a regression-tested guarantee.
Quick Check
Test your understanding of rules testing.
Recap
You can now validate rules with confidence.
- Use the Rules Playground for quick manual checks
- Use the Local Emulator for repeatable runs
- Write tests with
assertSucceeds/assertFails - Cover both access and validation, both directions
- Run rule tests in CI
常见问题解答
「测试与调试安全规则」课时是免费的吗？
是的 — 「测试与调试安全规则」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Firebase Auth & Realtime Database Apps 课程的其余内容，请升级到 CoddyKit PRO。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
「测试与调试安全规则」这节课中我会学到什么？
通过模拟请求、使用 Rules Playground、借助模拟器编写自动化测试并阅读拒绝消息，增强对 Realtime Database 规则的信心。 你通过在浏览器中直接运行的动手代码来练习 Firebase Auth & Realtime Database Apps，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Firebase Auth & Realtime Database Apps 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Firebase Auth & Realtime Database Apps 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「测试与调试安全规则」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Firebase Auth & Realtime Database Apps 课中编写并运行代码吗？
能。每节 Firebase Auth & Realtime Database Apps 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。