Firebase Realtime Database rules for specific node of structure

Question

Before creating a new user I want to check if creating username property already exists in Firebase Database.

Checking function is:

let databaseRef = Database.database().reference()
databaseRef.child("users").queryOrdered(byChild: "username").queryEqual(toValue: loginRegisterTextField.text).observeSingleEvent(of: .value, with: { (snapshot: DataSnapshot) in
   if snapshot.exists() {
       print("Login exists") 
   } else {
       print("Login does not exist")
  }
})

JSON is:

Rules are for node users:

{
  "rules": {
        
    "users" : { 
      ".read": "auth != null",

          "$uid" : {
            ".write": "auth != null && auth.uid == $uid",
        }
    },

Is it possible to write a rules to check existing of username without a new uid?

The username child node you're using has nothing to do with a UID, and in fact, doesn't have anything to do with rules either. The problem with this code flow is that, in order to check to see if a username exists, the user must be authenticated, but if this is a new user, they are not yet authenticated, so that won't work. One option is to create the firebase account first (which authenticates the user) then ask them to create a username. In that scenario, your code will work pretty much as is. Otherwise you can keep a publicly accessible username list, or leverage cloud functions. — Jay
– Jay, Commented Dec 24, 2021 at 17:53
@Jay Thanks, I've the same thought to create a new readable branch with usernames but I hoped until the last don't do it) — Stanislav Putilov
– Stanislav Putilov, Commented Dec 24, 2021 at 18:22

Frank van Puffelen · Accepted Answer · 2021-12-24 15:16:01Z

1

There is no way to check for a specific value across a JSON branch in security rules. This has been covered quite a few times before, so I recommend checking some of these search results.

But you can make your query on /users more secure, by only allowing that specific query, and not allowing people to read all of /users. To secure the query you could some something like:

{
  "rules": {     
    "users" : { 
      ".read": "auth != null && 
                query.orderByChild == 'username' &&
                query.equalTo !== null",
      ...

This is the first time I've used query.equalTo !== null, so there may be some small mistakes in that part, but the flow should be clear.

answered Dec 24, 2021 at 15:16

Frank van Puffelen

603k85 gold badges895 silver badges868 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Jay Over a year ago

I think the OP wants to check if the username exists before creating the Firebase user (they mentioned no uid) and if that's the case, the user won't be auth'd yet. I may be reading the question wrong though.

Frank van Puffelen Over a year ago

Ah, that's a good point Jay. In that case, they can remove the auth != null part from the .read rule on /users and still only allow the specific query that they code uses.

Stanislav Putilov Over a year ago

@Jay you are right, I want to check if the username exists before creating the Firebase user

Stanislav Putilov Over a year ago

@FrankvanPuffelen thanks for another point of view to my problem.

Frank van Puffelen Over a year ago

@StanislavPutilov As said in my comment above, if you remove auth != null && from the rules I shared, even unauthenticated users can perform the username query - but that's all they can do then.

|

Collectives™ on Stack Overflow

Firebase Realtime Database rules for specific node of structure

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related