基于用户的访问控制
实现基于已通过身份验证的用户 ID 和角色授予或拒绝读写权限的规则
基于用户的访问控制 是 CoddyKit 上的免费 Firebase Auth & Realtime Database Apps 课时。 这是第 2 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Firebase Auth & Realtime Database Apps 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Control Access by User
Welcome to this lesson! In secure applications, it's crucial to control who can access what data. This is known as User-Based Access Control.
Firebase Realtime Database Security Rules allow you to define precise permissions based on the user who is currently logged in.
Meet the 'auth' Variable
Inside your security rules, Firebase provides a special auth variable. This variable contains information about the currently authenticated user.
auth.uid: The unique ID of the logged-in user.auth.token: An object containing custom claims and other token details (e.g., email).
If no user is logged in, auth will be null.
Authenticated Users Only
The simplest form of user-based access is to ensure only authenticated users can read or write any data.
You can achieve this by checking if the auth variable is not null.
{
"rules": {
".read": "auth != null",
".write": "auth != null"
}
}Users Read Their Own Data
Often, you want users to only read data that belongs to them. Imagine a /users node where each user has a sub-node with their UID.
We can use a wildcard variable ($uid) in the path to match the current user's ID.
{
"rules": {
"users": {
"$uid": {
".read": "auth.uid == $uid"
}
}
}
}Users Write Their Own Data
Similarly, you can restrict write access so users can only modify their own data. This prevents one user from changing another's profile.
The rule is very similar to the read rule, just applied to .write.
{
"rules": {
"users": {
"$uid": {
".write": "auth.uid == $uid"
}
}
}
}Read & Write Your Own Profile
Let's combine the read and write rules. This common pattern allows users full control over their own specific data node, often used for user profiles.
Here, $userId is a placeholder for an actual user's UID.
{
"rules": {
"profiles": {
"$userId": {
".read": "auth.uid == $userId",
".write": "auth.uid == $userId"
}
}
}
}Post Ownership Example
Consider a 'posts' section where anyone can read posts, but only the creator can edit or delete their own post.
We assume each post object has an ownerId field. We use data.ownerId to refer to the existing owner ID in the database.
{
"rules": {
"posts": {
"$postId": {
".read": "true",
".write": "auth.uid == data.ownerId"
}
}
}
}Validating Data with Auth
Beyond just who can write, you can also validate what data they write. For instance, ensuring that when a user creates an item, they correctly set themselves as the owner.
The newData variable refers to the data being written.
{
"rules": {
"items": {
"$itemId": {
".write": "auth != null",
".validate": "newData.ownerId == auth.uid"
}
}
}
}Introducing User Roles
For more complex access, you can define roles like 'admin' or 'moderator'. These roles are often stored as custom claims in the user's authentication token.
You can then check for these roles in your rules using auth.token.
{
"rules": {
"adminContent": {
".read": "auth.token.isAdmin == true",
".write": "auth.token.isAdmin == true"
}
}
}Quick Check on Access
Consider the following Realtime Database Security Rules:
{
"rules": {
"messages": {
"$messageId": {
".read": "auth.uid == data.senderId",
".write": "auth.uid == data.senderId"
}
}
}
}If user "user123" is authenticated and tries to read a message where data.senderId is "user456", will they succeed?
Recap: User Access Rules
You've learned how to implement powerful user-based access control in Firebase Realtime Database Security Rules!
- The
authvariable provides current user details. - You can restrict access to authenticated users (
auth != null). - Users can be granted read/write access to their own specific data using
auth.uid == $uid. - You can validate incoming data using
newDataandauth.uid. - Roles can be used to grant access to specific user groups.
Next, explore how to validate the data itself!
常见问题解答
「基于用户的访问控制」课时是免费的吗？
是的 — 「基于用户的访问控制」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Firebase Auth & Realtime Database Apps 课程的其余内容，请升级到 CoddyKit PRO。 Firebase Auth & Realtime Database Apps 课程共包含 4 节课。
「基于用户的访问控制」这节课中我会学到什么？
实现基于已通过身份验证的用户 ID 和角色授予或拒绝读写权限的规则 你通过在浏览器中直接运行的动手代码来练习 Firebase Auth & Realtime Database Apps，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Firebase Auth & Realtime Database Apps 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Firebase Auth & Realtime Database Apps 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 2 节课，共 4 节。
「基于用户的访问控制」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Firebase Auth & Realtime Database Apps 课中编写并运行代码吗？
能。每节 Firebase Auth & Realtime Database Apps 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。