理解安全规则语法
掌握 Firebase Realtime Database 安全规则的语法和结构，以定义访问权限
理解安全规则语法 是 CoddyKit 上的免费 Firebase Auth & Realtime Database Apps 课时。 这是第 1 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Firebase Auth & Realtime Database Apps 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Why Security Rules?
Welcome to Realtime Database Security Rules! These rules are super important for keeping your data safe and controlling who can do what in your Firebase app.
Think of them as bouncers for your database: they check every request to read, write, or update data, and decide if it's allowed or not.
Your Rules File
Firebase Realtime Database Security Rules are defined in a JSON file, usually named rules.json. You'll upload this file to your Firebase project.
The entire set of rules is wrapped under a top-level "rules" key, like this:
{
"rules": {
// Your security rules go here!
}
}Default Open Rules
When you first create a Realtime Database, Firebase often provides a very open set of rules. This allows anyone to read and write data, which is great for getting started quickly, but terrible for production!
These rules look like this:
{
"rules": {
".read": "true",
".write": "true"
}
}Targeting Data Paths
Rules are applied based on the path to your data. You nest rules within the "rules" object to target specific parts of your database, just like folders in a file system.
For example, to set rules for /users or /messages:
{
"rules": {
"users": {
// Rules for data under /users
},
"messages": {
// Rules for data under /messages
}
}
}Basic Read Permissions
The ".read" rule determines who can retrieve data from a specific path. If a read request matches a path with ".read": "true", it's allowed. If it's "false", it's denied.
Here's how you might set read permissions:
{
"rules": {
"publicPosts": {
".read": "true" // Anyone can read blog posts
},
"secretDocs": {
".read": "false" // No one can read secret documents
}
}
}Basic Write Permissions
Similarly, the ".write" rule controls who can create, update, or delete data at a given path. Setting it to "true" allows writes, and "false" denies them.
Let's look at some write rule examples:
{
"rules": {
"guestbook": {
".write": "true" // Anyone can sign the guestbook
},
"adminSettings": {
".write": "false" // No one can change admin settings yet
}
}
}Combining Read & Write
You can define both ".read" and ".write" rules for the same path. Firebase evaluates them independently.
For example, to make a path readable by everyone but writable by no one (yet):
{
"rules": {
"announcements": {
".read": "true", // Everyone can see announcements
".write": "false" // No one can post new announcements
}
}
}Dynamic Paths with Wildcards
What if you have many items under a path, like individual user profiles (/users/user123, /users/user456)? You don't want to write a rule for each one!
Use a wildcard variable, prefixed with $, to match any child node. This variable can then be used within the rule itself.
{
"rules": {
"profileData": {
"$userId": {
".read": "true", // Anyone can read any user's profile
".write": "false" // But no one can edit them yet
}
}
}
}`auth` & `data`: Rule Helpers
When writing more advanced rules, you'll often need to check who is making the request or what data already exists. Firebase provides special variables for this:
auth: Contains information about the currently authenticated user (if any).data: Refers to the data that already exists at the path being accessed.newData: Refers to the data being written (only for write/validate rules).
These let you create smart rules, like "only the owner can edit their profile." We'll dive into these in upcoming lessons!
Syntax Check
Given the Firebase Realtime Database Security Rules below, which statement is true?
{
"rules": {
"posts": {
".read": "true",
"comments": {
".write": "false"
}
},
"users": {
"$userId": {
".read": "true"
}
}
}
}Lesson Summary
Great job! In this lesson, we covered the foundational syntax of Firebase Realtime Database Security Rules:
- Rules live in a
rules.jsonfile. - Rules are nested to target specific data paths.
".read"and".write"control read and write access.- Wildcards (
$variable) make rules dynamic for child nodes. - You got a sneak peek at context variables like
authanddata.
Next, we'll dive deeper into using these rules for user-based access control!
常见问题解答
「理解安全规则语法」课时是免费的吗？
是的 — 「理解安全规则语法」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Firebase Auth & Realtime Database Apps 课程的其余内容，请升级到 CoddyKit PRO。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
「理解安全规则语法」这节课中我会学到什么？
掌握 Firebase Realtime Database 安全规则的语法和结构，以定义访问权限 你通过在浏览器中直接运行的动手代码来练习 Firebase Auth & Realtime Database Apps，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Firebase Auth & Realtime Database Apps 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Firebase Auth & Realtime Database Apps 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 1 节课，共 4 节。
「理解安全规则语法」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Firebase Auth & Realtime Database Apps 课中编写并运行代码吗？
能。每节 Firebase Auth & Realtime Database Apps 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。