Coding

Firebase Database Rules | Firebase with Abe (Google Developer)

  • 00:00:06 this video and the previous videos we
  • 00:00:08 had a look at parvis general and then a
  • 00:00:11 total structure or data now we get our
  • 00:00:13 structured data we get part of a setup
  • 00:00:15 but now we wanna ensure that well we
  • 00:00:17 write to this data correctly yep and
  • 00:00:19 what can you tell us they're about the
  • 00:00:22 rules basically which is a super
  • 00:00:23 important feature yeah so the firebase
  • 00:00:25 security rules are basically how you
  • 00:00:26 restrict who can write your jism because
  • 00:00:29 when you're dealing with a database that
  • 00:00:31 gets written to from client devices the
  • 00:00:33 likelihood someone could try to add
  • 00:00:35 malicious data or you're you are just
  • 00:00:37 not filtering out all the veteran of a
  • 00:00:40 night right it's very high so we want to
  • 00:00:42 use these security rules which will this
  • 00:00:44 kind of JavaScript D type language to
  • 00:00:48 say here's who can write where kids what
  • 00:00:51 they can write that way you know that
  • 00:00:52 the schema and the data that you're
  • 00:00:54 having in your database will be great
  • 00:00:56 then rendering that perfectly and
  • 00:00:58 everyone will do what's expected and you
  • 00:01:00 will be leaking user data to anyone who
  • 00:01:02 shouldn't have it yes so like I said
  • 00:01:05 this is a Java Script like language that
  • 00:01:08 will kind of mimic the structure of your
  • 00:01:09 database to let you let you lock it down
  • 00:01:13 before we dive is that there's one screw
  • 00:01:16 important thing because you could think
  • 00:01:17 well why do I need this I could check
  • 00:01:19 this in my client code right I could
  • 00:01:21 basically do validation there I couldn't
  • 00:01:23 even check the user ID there's one big
  • 00:01:25 issue with that that your client that
  • 00:01:27 code is especially with the web
  • 00:01:29 application Joseph's always exposed so
  • 00:01:31 even if you min apply it and make it
  • 00:01:33 really unreadable there's always a
  • 00:01:35 chance of getting there and basically
  • 00:01:37 disabling your validation for example
  • 00:01:39 and that's what we need to do that all
  • 00:01:41 the time every time on the server you
  • 00:01:42 can't have delegation on a client to
  • 00:01:44 improve user experience but never just
  • 00:01:46 rely on that exactly yeah you want to
  • 00:01:48 use your contest validation to say oh
  • 00:01:50 but that isn't a valid email address or
  • 00:01:53 you know you you clearly didn't need
  • 00:01:54 that character in there whatever but in
  • 00:01:56 terms of saying you cannot write that
  • 00:01:58 I'm not allowing you to write that
  • 00:02:00 that's where you'll go zero yeah so why
  • 00:02:02 don't we do a little bit into that with
  • 00:02:03 with an example yeah yeah so let's go in
  • 00:02:06 your data for a second and look at our
  • 00:02:08 structure and the simplest possible use
  • 00:02:11 case here is like a user profile so if I
  • 00:02:15 have a profile we were talking before
  • 00:02:17 about using this user ID here too
  • 00:02:19 look up who created this message and
  • 00:02:22 using that to pull in a photo URL or
  • 00:02:25 anything like that so let's build with
  • 00:02:27 that structure in here so we can see it
  • 00:02:29 and then we'll write the rules to lock
  • 00:02:30 it down to only I can edit my profile
  • 00:02:32 and you can edit yours so we have this
  • 00:02:34 unique ID that came from our app so in
  • 00:02:36 this case I'm going to type it in in
  • 00:02:38 reality you could make the structure
  • 00:02:40 when your user signs in do it on the
  • 00:02:41 client do it with a cloud function
  • 00:02:43 whatever you want but here I'll just
  • 00:02:44 type it in for fun so we'll go up here
  • 00:02:47 we'll add a new top-level node called
  • 00:02:49 users then under that will use this user
  • 00:02:53 ID as a key I'll paste that in there
  • 00:02:55 that is copied from that then we'll have
  • 00:02:58 a name and we'll causes your Abraham
  • 00:03:01 asking and you know photo URL I don't
  • 00:03:05 have one so I won't actually going back
  • 00:03:06 but we an add that and we'll get named
  • 00:03:09 Abraham Haskins so that's our user
  • 00:03:11 profile right now anyone could come up
  • 00:03:13 with this right if you knew my crazy ID
  • 00:03:15 which you would if you came in and
  • 00:03:17 clicked at this message that your client
  • 00:03:19 read the message you ever got your ID so
  • 00:03:21 we need to lock this down to remove the
  • 00:03:24 rules by default you have two rules in
  • 00:03:28 your firebase database you have your
  • 00:03:30 read rule which obviously controls your
  • 00:03:32 ability to read data and your very rule
  • 00:03:33 which controls your ability to write it
  • 00:03:35 and the defaults are opt doesn't equal
  • 00:03:38 null revolt mm-hmm this is already a
  • 00:03:41 little strange because we now know the
  • 00:03:43 soft object is but it's pretty
  • 00:03:45 straightforward
  • 00:03:46 the object is your user so when you sign
  • 00:03:49 in with any type of authentication
  • 00:03:51 firebase authentication and try to write
  • 00:03:53 to the real-time database the user ID
  • 00:03:57 the information about what's up a
  • 00:03:59 provider to github or Google or whatever
  • 00:04:00 August past through to these security
  • 00:04:02 rules as this alt object so this is
  • 00:04:06 opposite you can think of it as your
  • 00:04:08 user resume to what we're saying here is
  • 00:04:10 that you can read all the data in my
  • 00:04:13 database
  • 00:04:13 if auth doesn't equal no if so in other
  • 00:04:18 words if offers anything or if you're
  • 00:04:20 ascendant yep if you're not signed in
  • 00:04:22 off it's just going to be nope it's oh
  • 00:04:24 it's going to be empty so you can't read
  • 00:04:26 anything if we change this to for
  • 00:04:28 example true that would mean anyone can
  • 00:04:31 read our data and that has some
  • 00:04:33 interesting side effects you can go and
  • 00:04:35 for example polio and Qatar they said if
  • 00:04:36 it's down education right now so you
  • 00:04:39 generally don't want to do that but you
  • 00:04:42 could if you really wanted to or if you
  • 00:04:43 were cut it up yeah I was not not mine
  • 00:04:49 it a boy's mother maybe fewer yet so you
  • 00:04:53 could do that but if we want to do
  • 00:04:55 control that's not on the database look
  • 00:04:58 like this is allowing reading of
  • 00:04:59 everything we need to step in a little
  • 00:05:03 bit but I think I think one cool thing
  • 00:05:05 though strategists will publish this
  • 00:05:06 will go over to this rule I will copy
  • 00:05:09 this link there's an MC open up a new
  • 00:05:11 tab paste this in and if we type in dot
  • 00:05:14 jason on the end of that URL it'll give
  • 00:05:18 us that permission to not commit because
  • 00:05:19 our rules are saying you can't you can't
  • 00:05:21 read that hospital no you're not
  • 00:05:22 authenticated so if we say read true
  • 00:05:25 published at hop back over here we'll
  • 00:05:28 get our entire database back now as we
  • 00:05:33 step in we're going to allow reads at
  • 00:05:35 different depths at different locations
  • 00:05:37 but we're not going to allow wreaths at
  • 00:05:39 the root like this what we're just
  • 00:05:41 saying pull my entire database ever yeah
  • 00:05:43 there's no reason any user we need to do
  • 00:05:45 that yet so let's make a profile so
  • 00:05:47 we'll leave that as often doesn't equal
  • 00:05:49 actually well completely remove that
  • 00:05:51 rule because we don't want anyone ever
  • 00:05:53 read at the root of our database and
  • 00:05:54 then we'll mimic the structure of our
  • 00:05:58 and quote yeah here I go
  • 00:06:02 will mimic the structure of our database
  • 00:06:05 so we'll have that and then there's a
  • 00:06:08 lot of crazy fun yes yes you're you're a
  • 00:06:12 mustache bracket oh that's that's a
  • 00:06:16 whole week all today oh yeah
  • 00:06:19 all right so have users and then under
  • 00:06:23 users will have dollar signs
  • 00:06:25 UID which I'll explain in a second then
  • 00:06:28 under that will have I'm just gonna copy
  • 00:06:33 and paste the whole dumb alt open I'm
  • 00:06:37 already I'm cool yeah
  • 00:06:38 and under here we'll have our read rule
  • 00:06:41 which will look like men sometimes read
  • 00:06:44 shell inches in they are it's like
  • 00:06:46 programming is too easy as general we
  • 00:06:48 definitely got to add in extra extra
  • 00:06:52 difficulty isn't equal no so what we've
  • 00:06:57 just done is made this hierarchy clean
  • 00:07:00 it come there we publish this if we go
  • 00:07:03 back over here we were regularly refresh
  • 00:07:06 this as soon as they permission to not
  • 00:07:08 yet we removed that renewal at the
  • 00:07:10 beginning or further of the database but
  • 00:07:12 now if you read users slashes specific
  • 00:07:16 user ID so this is a wild card
  • 00:07:18 yeah so we're sending users is going to
  • 00:07:21 line up with users here this top of them
  • 00:07:24 then it's the wild-card is going to
  • 00:07:26 match this crazy ID Elton so give you
  • 00:07:29 any any I yep and then down here we're
  • 00:07:32 just saying now you can read it so the
  • 00:07:34 table card here isn't going to be used
  • 00:07:36 right away but we can use it in a room
  • 00:07:39 so I guess that this off object is
  • 00:07:42 actually our user it has all the
  • 00:07:44 properties about who is trying to make
  • 00:07:45 this request so if we set off that you
  • 00:07:48 ID equals dollar sign UID digital is now
  • 00:07:54 going to say the only person who can
  • 00:07:56 read this is the person whose UID that's
  • 00:07:59 been secured and verified by firebase
  • 00:08:01 authentication matches this UID mmm-hmm
  • 00:08:05 so we've not lock this down so if I go
  • 00:08:08 in here even if I like stuffed into you
  • 00:08:11 know deep down let's let's run these
  • 00:08:13 down into this location and we can read
  • 00:08:19 this type of signal also to slash users
  • 00:08:22 slash that shift elements to keep there
  • 00:08:27 you go it's going to give us a
  • 00:08:28 permission denied but because we run
  • 00:08:31 authenticated which is exactly what we'd
  • 00:08:32 expect but if we went into our app and
  • 00:08:34 tried to read that
  • 00:08:35 it'd be all good but this isn't quite
  • 00:08:38 the case we want write a user profile
  • 00:08:39 should be readable by everyone but it
  • 00:08:42 should it be writable everyone so we'll
  • 00:08:45 change the through a rule and then we'll
  • 00:08:48 change the dot read
  • 00:08:51 the reason to green actually to say true
  • 00:08:56 by default we already saw it basically
  • 00:08:59 but by default if we don't specify read
  • 00:09:01 it it's all sinful but everything is
  • 00:09:03 locked down by people exactly exactly so
  • 00:09:05 now anyone can read that profile but
  • 00:09:08 only only you can write to it and we can
  • 00:09:11 check out one more time I can actually
  • 00:09:13 step all the way down into this because
  • 00:09:16 URL command ztp is that in Jason and it
  • 00:09:21 will let us read it now you'll notice
  • 00:09:24 this object that gets returned has a
  • 00:09:27 property called name and it's a of
  • 00:09:29 haskins which is just like the data we
  • 00:09:32 have under that object but we can
  • 00:09:34 actually set in a level deeper if we
  • 00:09:37 wanted to so we can say slash fashion
  • 00:09:41 name and pull out just the name and then
  • 00:09:45 it's just a string so by giving someone
  • 00:09:48 read access at the user level we give
  • 00:09:51 them read access completely read access
  • 00:09:53 to everything under echo spectral we're
  • 00:09:55 talking about where you're loading data
  • 00:09:57 you're always loading all of it onto
  • 00:09:58 that location if you're giving someone
  • 00:10:00 to read access to something you're
  • 00:10:01 giving them read access to everything on
  • 00:10:03 dissolve location but at this point
  • 00:10:06 we've lost the step that user profile is
  • 00:10:08 not getting changed unless you are the
  • 00:10:10 person who is signing with that UID and
  • 00:10:12 that's not happening unless you sign it
  • 00:10:14 with that residential and you have to do
  • 00:10:16 anything special on your client and
  • 00:10:18 forces as long as you've signed in your
  • 00:10:21 you're good to go okay cool um and do
  • 00:10:24 suspicious it will go down so if we have
  • 00:10:26 read access there we can also read the
  • 00:10:29 note space here but doesn't it doesn't
  • 00:10:32 doesn't also propagate up so if we have
  • 00:10:34 some read or write access level user IP
  • 00:10:38 can we also write to user since yeah so
  • 00:10:41 you can review can write anywhere below
  • 00:10:43 so if I'm if I have write access to
  • 00:10:46 dollar sign user ID I can write to
  • 00:10:49 anything below edit so I can write to
  • 00:10:51 the name I can write to the account as a
  • 00:10:53 whole but if I have write access only to
  • 00:10:56 my account and I try to write at users
  • 00:10:59 that even if the only change to the data
  • 00:11:01 my you ready it would be disallowed so
  • 00:11:04 you have to write to a location where
  • 00:11:05 you have either an explicit rule or one
  • 00:11:08 of the parents has a reader right room
  • 00:11:10 for what you're trying to write okay and
  • 00:11:12 we do a read and write here
  • 00:11:14 yep I believe there also is a burdock
  • 00:11:16 like valios
  • 00:11:17 yeah what's the role of that now that's
  • 00:11:18 compared to two like yep so read
  • 00:11:21 obviously reading writing is saying can
  • 00:11:24 I write this or not validating is for
  • 00:11:26 checking that what you're writing is
  • 00:11:28 okay so where's writing is I am like
  • 00:11:32 allowed I have the right you ID valid if
  • 00:11:34 you're checking is this a number is this
  • 00:11:36 a string is it within the length does it
  • 00:11:38 match the trigger all of those things
  • 00:11:40 which really aren't part of the
  • 00:11:41 permission model but part of this schema
  • 00:11:44 that gets enforced in a dot validated
  • 00:11:46 role so we could add one for our user
  • 00:11:49 profile we could say under this so we'll
  • 00:11:52 have a child that is named and we'll
  • 00:11:57 have what we actually might add it to to
  • 00:11:59 mess just maybe because we can but or
  • 00:12:02 just from our weapons and now we have
  • 00:12:03 this looks good you know we could force
  • 00:12:05 said it has to be like six characters
  • 00:12:07 long or something like that
  • 00:12:08 yeah so we can do a bunch of different
  • 00:12:10 stuff like that in this case we're using
  • 00:12:12 our UID here so what would you want to
  • 00:12:17 enforce on the method everybody said
  • 00:12:19 it's a cause and should be at least our
  • 00:12:21 own yeah something like that
  • 00:12:22 all right so let's do that we can go and
  • 00:12:23 make another structure so we have users
  • 00:12:25 but because messages are separate we
  • 00:12:28 need to make another structure in here
  • 00:12:29 oh this is a great catch actually so
  • 00:12:33 this rule is still here yes aunt does an
  • 00:12:35 equal null because that rule is still
  • 00:12:37 here this rule would actually be
  • 00:12:39 overwritten because this is saying at
  • 00:12:41 the right yeah anyone can write so if we
  • 00:12:43 didn't delete that that would allow
  • 00:12:45 somebody to write in any location so we
  • 00:12:47 really need it as we thought yep
  • 00:12:49 absolutely
  • 00:12:50 all right so we'll do that message is
  • 00:12:53 node max so say messages and do
  • 00:13:01 under that we'll do that same wild card
  • 00:13:04 because our messages each have those
  • 00:13:06 crazy ideas so we see a wild card match
  • 00:13:08 Camacho and Peter Wong I'm so practicing
  • 00:13:12 with the keyboard day yeah okay good
  • 00:13:14 bananas I'm going to be like a pro to
  • 00:13:18 imagine so
  • 00:13:19 yep you're correct message kids and
  • 00:13:22 we'll call this message ID this can be
  • 00:13:25 anything you want yet whatever makes
  • 00:13:26 sense to you is what that should be
  • 00:13:28 called under there so now we're at the
  • 00:13:31 messages level so in this case who
  • 00:13:33 should be able to write a message
  • 00:13:35 I think everyone who's opening at it yes
  • 00:13:38 with me okay that's right alright so
  • 00:13:39 we'll write that rule in real quick so
  • 00:13:41 we'll said do that right anyone who has
  • 00:13:47 off doesn't equal no good all right
  • 00:13:53 who should be able to read messages
  • 00:13:55 let's say everyone should be able to me
  • 00:13:57 so here's an interesting point like I
  • 00:14:00 was saying before if I was trying to
  • 00:14:02 write at users and even if I was only
  • 00:14:04 writing through UID I wouldn't be
  • 00:14:06 allowed with this rule yeah that same
  • 00:14:08 thing happened here with reading if I
  • 00:14:10 wanted to read every message and even if
  • 00:14:13 the read rule on the message ID allowed
  • 00:14:16 it it wouldn't allow me to read messages
  • 00:14:19 yes guru block down but evil yep so we
  • 00:14:22 have to go a little higher to be able to
  • 00:14:24 get the list of every message for this
  • 00:14:26 writer for this read rule so if they
  • 00:14:28 read and on this one we'll say aw
  • 00:14:30 doesn't equal not like that what we're
  • 00:14:32 looking for
  • 00:14:32 yeah all right so now we're saying
  • 00:14:35 anyone can read messages as a list they
  • 00:14:38 can get every message ever but these
  • 00:14:40 rules are the message ID we're stepping
  • 00:14:42 into because we're going to do something
  • 00:14:43 a little different all right so message
  • 00:14:47 ID now I'm here we wanted to validate
  • 00:14:49 the content length right yes but before
  • 00:14:51 we can actually jump into the app and
  • 00:14:52 show how it's working so far
  • 00:14:54 absolutely that I've read and write set
  • 00:14:55 up so we can simply open the application
  • 00:14:57 still running and we need to sign in
  • 00:15:01 there anyway so let me do that create
  • 00:15:04 the user before hit sign in and now we
  • 00:15:09 can what we're reading already so the
  • 00:15:11 other time
  • 00:15:11 yep right that works and about the
  • 00:15:13 console too super
  • 00:15:14 getting any hammers people you know what
  • 00:15:18 it's good to good yeah it's very very
  • 00:15:22 difficult all okay let's now try it
  • 00:15:24 again and let's end and you message here
  • 00:15:27 maybe mm-hmm let's hit Send and would so
  • 00:15:32 that's what okay even maybe before we
  • 00:15:34 continue writing it some screwed it up
  • 00:15:37 and go back to our rules yeah and if we
  • 00:15:40 set off simply to false here then we
  • 00:15:45 shouldn't be able to do that so we can
  • 00:15:46 still read everything so we still see
  • 00:15:49 our messages here but if I now simply
  • 00:15:52 sentences and the same message again
  • 00:15:54 bizarre it was out there for a refurb
  • 00:15:56 three if ii bejaz lost just duty
  • 00:15:58 prompted f word to some optimistic
  • 00:16:01 updating that's exactly and that's
  • 00:16:02 something to keep in mind every stay
  • 00:16:04 optimistic updated the firebase says oh
  • 00:16:06 I think this red succeeded until realize
  • 00:16:08 that didn't that didn't make it a server
  • 00:16:09 that was never in the data's no one ever
  • 00:16:11 saw that but your client side up so I
  • 00:16:13 thought that was okay and then enrolled
  • 00:16:14 yeah Joanne we see the error message
  • 00:16:16 here to we're not handling it here
  • 00:16:17 that's why it's just printed there but
  • 00:16:18 we could catch that and outfit their
  • 00:16:20 Krishna nicer way but here we got a
  • 00:16:23 permission denied error so that's
  • 00:16:25 exactly what we wanted to see because we
  • 00:16:26 got some foolishness so yep yep 10 yo is
  • 00:16:31 a great so now we're back to the
  • 00:16:34 original state and now we can try to
  • 00:16:36 validate it to make sure that we only
  • 00:16:38 can write messages which have at least
  • 00:16:40 six characteristics on yet so we should
  • 00:16:42 be able to score heads in here right a
  • 00:16:45 new valid a rule mm-hmm of course it's
  • 00:16:48 all documented on the sides if you need
  • 00:16:50 help following along with us
  • 00:16:51 link can be found in the bishop's for
  • 00:16:54 PDF and we have a reference for all
  • 00:16:55 these variables everything like that so
  • 00:16:58 when you write data to firebase it's
  • 00:17:01 going to come in to the security rules
  • 00:17:03 and two different ones one is data data
  • 00:17:06 is the data app the location you're
  • 00:17:08 writing when the right happens yeah
  • 00:17:10 so what that means is if I have a user
  • 00:17:13 profile and I write to it data is the
  • 00:17:16 data that's currently that not the data
  • 00:17:18 coming in with it right so we have data
  • 00:17:20 and then we also
  • 00:17:21 have new data and both our research
  • 00:17:23 words we have to be have them can't we
  • 00:17:25 can't take anything with a dollar sign
  • 00:17:26 in front of it basically but these are
  • 00:17:28 these are agents built-in – yes exactly
  • 00:17:30 so new data will be the data that is
  • 00:17:34 coming in with the right what's their
  • 00:17:36 time – right
  • 00:17:37 so in this case we're going to go and we
  • 00:17:39 care about the content field it's what
  • 00:17:41 it's called
  • 00:17:41 so it's a content and it's validated
  • 00:17:43 rule is going to happen on the content –
  • 00:17:48 all right then we'll say new data
  • 00:17:56 doctrine Val mm-hmm I can type that in
  • 00:18:00 same job link also just a professional
  • 00:18:03 development sense because that's also
  • 00:18:05 how we can to treat data what we get is
  • 00:18:07 in decline exactly and we say greater
  • 00:18:09 than 6mm so just like a string in
  • 00:18:12 JavaScript we can check it and we hit
  • 00:18:14 published that's been published and one
  • 00:18:16 of the really cool things is if I had a
  • 00:18:17 mistake I didn't make any mistake here
  • 00:18:19 but if the length was in a field eval
  • 00:18:22 wasn't right it would tell me right now
  • 00:18:24 this isn't something that would like
  • 00:18:25 bubble up in your application if you
  • 00:18:27 write your rules
  • 00:18:27 although the logic might not be right
  • 00:18:29 these variable names and stuff will be
  • 00:18:31 right at each other's public okay so we
  • 00:18:33 hop over here now and what they should
  • 00:18:35 do is enforce the length of the content
  • 00:18:37 field so try this with a new message
  • 00:18:40 that's nice and long that should senders
  • 00:18:42 fine yes but if we try to shorter
  • 00:18:44 message that's only three characters we
  • 00:18:46 just send flashes and we get failed
  • 00:18:49 permission denied it looks the same way
  • 00:18:52 on a client to security reasons we don't
  • 00:18:53 want to say on the client like oh you
  • 00:18:55 didn't fit this criteria because then
  • 00:18:58 people would like work around it and
  • 00:18:59 they try to get through your security so
  • 00:19:01 we just say Commission denied you can't
  • 00:19:03 write that that message is too short but
  • 00:19:05 you could definitely catch that and if
  • 00:19:06 you're doing client-side validation you
  • 00:19:08 do the same validation – oh it's too
  • 00:19:10 short
  • 00:19:10 I can bubble up a good message and
  • 00:19:12 there's xxe the thing we talked about
  • 00:19:14 earlier so here obviously dis message
  • 00:19:16 alone doesn't allow us to create a good
  • 00:19:17 user experience because we couldn't tell
  • 00:19:19 is this because we're not allowed yeah
  • 00:19:21 what's wrong it's not like the off
  • 00:19:22 message right that wasn't really nice so
  • 00:19:24 that's why it's important to do decline
  • 00:19:26 that authentication a validation when we
  • 00:19:28 were smells check this before we send it
  • 00:19:30 and
  • 00:19:30 someone disables dad well then we don't
  • 00:19:33 need to show a good error message
  • 00:19:35 anyways yes yes and generally if you get
  • 00:19:37 permission deny there's those are
  • 00:19:39 malicious users these aren't the type of
  • 00:19:41 thing we expect a normal user in the
  • 00:19:43 course of juicing you have to hit yeah
  • 00:19:44 so if they are hitting those you don't
  • 00:19:46 have to really be that nice to them yeah
  • 00:19:48 if they're probably probably not being
  • 00:19:50 nice to you because through the trees
  • 00:19:51 should manage nice stuff in your client
  • 00:19:53 app anyway yeah exactly yeah
  • 00:19:57 and validation rules are a little
  • 00:19:58 different there but in general should be
  • 00:19:59 in the middie permission designer yeah
  • 00:20:02 cool so the very last thing in terms of
  • 00:20:06 our message that I want to implement is
  • 00:20:07 not want to make sure
  • 00:20:08 right now we're constricting who can use
  • 00:20:10 who can write to their profile and we're
  • 00:20:13 relying on the data here inside of our
  • 00:20:16 messages this usually built to be the
  • 00:20:19 right user ID that we're not enforcing
  • 00:20:21 that yeah so anyone could write anyone's
  • 00:20:23 user ID and it would end up looking in
  • 00:20:26 the applications like people sent by you
  • 00:20:28 or if I need when that's not who's
  • 00:20:30 sending it yep so let's make sure that
  • 00:20:32 this user ID field when it's being
  • 00:20:34 written is the UID of the actual user so
  • 00:20:38 we can do that same thing here where we
  • 00:20:40 have will step in to a field this one's
  • 00:20:43 called user ID just like in our actual
  • 00:20:46 data I will say pull up that and this
  • 00:20:50 will be another validation role this
  • 00:20:52 could be a write rule but remember that
  • 00:20:55 we're giving them right permission at a
  • 00:20:56 higher level so if we had a right rule
  • 00:20:59 here it wouldn't be enforced because we
  • 00:21:01 give the information up here so it has
  • 00:21:03 to be a validating rule which allows
  • 00:21:05 them to write I go to this location or
  • 00:21:07 this location and have it be validated
  • 00:21:09 all right and then we'll just say new
  • 00:21:12 data file and that's going to equal
  • 00:21:16 equal equal ah you ready it publish
  • 00:21:21 that's all you need and now no one can
  • 00:21:23 read a user ID that's not various and I
  • 00:21:25 don't believe we have a super simple way
  • 00:21:27 to show us in the in the app but we
  • 00:21:28 could try to pack it and write data and
  • 00:21:30 it would
  • 00:21:31 we not let us edit so we know that not
  • 00:21:34 only is this profile locked down to the
  • 00:21:36 right user but every message that comes
  • 00:21:38 in has the real your idea crew rotor
  • 00:21:40 yeah that that makes makes a lot of
  • 00:21:43 sense can actually I guess now we can we
  • 00:21:47 can show if we add a new user and edit
  • 00:21:48 the code here arm could simply our code
  • 00:21:54 D oh yeah I'm saying that I write it now
  • 00:21:56 a Big Island down with something you
  • 00:21:58 can't do it with disuse or even simply
  • 00:22:00 just at any random string here it
  • 00:22:03 doesn't matter so in this case it's
  • 00:22:05 random but it could be another user ID
  • 00:22:07 and admins ID anything like that that a
  • 00:22:09 malicious user might get their hands on
  • 00:22:10 exactly and if we know safe this and
  • 00:22:13 quickly log in again you saw the Pyrates
  • 00:22:26 all to make sure that we can test
  • 00:22:27 multiple yeah that my friendly error
  • 00:22:29 message probably on a provides from the
  • 00:22:31 year a speaker yeah and now we can see
  • 00:22:35 that if we open up the console and would
  • 00:22:38 you like some message here you're gonna
  • 00:22:40 get out permission not because we well
  • 00:22:43 try to override this is ready which
  • 00:22:46 doesn't worry yep
  • 00:22:47 and you mentioned something else very
  • 00:22:49 important that in the rules very birth
  • 00:22:55 question is what's the exact difference
  • 00:22:57 we could be between right and delegate
  • 00:22:59 because obviously you can use the new
  • 00:23:02 data variables and so on yes also in the
  • 00:23:04 right here at i/o we can no that's not a
  • 00:23:06 difference the technical differences in
  • 00:23:08 how they castrate which is an applicated
  • 00:23:10 way of saying this right rule even if I
  • 00:23:13 put another retro key content instead of
  • 00:23:16 that validate rule this rule would be
  • 00:23:18 overwritten
  • 00:23:19 every time that by the parent one it
  • 00:23:21 would be ran if they were trying to
  • 00:23:23 write specifically to messages message
  • 00:23:25 ID content but otherwise this parent
  • 00:23:28 location is going to be the right role
  • 00:23:29 that gets rid validation rules get
  • 00:23:32 applied at any location so if I'm
  • 00:23:33 writing even though like messaging and
  • 00:23:36 I'm writing a really deep object that's
  • 00:23:37 message
  • 00:23:38 message-id whatever whatever those
  • 00:23:39 validation rules have to pass
  • 00:23:42 so the validation rules are like I said
  • 00:23:44 for enforcing schemas of making sure
  • 00:23:46 that this data if it gets in here in
  • 00:23:48 regardless of what allows them to do the
  • 00:23:50 right that it matches the format you
  • 00:23:51 want it to match that's what you do in a
  • 00:23:53 validation that's really important to
  • 00:23:55 know because it can be confusing because
  • 00:23:57 you have two ways of controlling the
  • 00:23:59 items accurate actually when terrorists
  • 00:24:02 can say right is for everything which is
  • 00:24:04 we're going to write permissions to
  • 00:24:06 authentication to or doctors indication
  • 00:24:08 of permissions who is able to write
  • 00:24:10 something or what can you write and
  • 00:24:11 validations we just four well
  • 00:24:13 publications yes yeah right it's for who
  • 00:24:15 relatives for what yeah yeah perfect
  • 00:24:18 and obviously if you want to dive deeper
  • 00:24:22 into that and learn about all the
  • 00:24:24 built-in variables because here we saw
  • 00:24:26 new data and eight Minch data you're man
  • 00:24:28 we come off but there are more than that
  • 00:24:31 and you can find them all in the
  • 00:24:33 firebase reference you can also find
  • 00:24:35 great articles here so if you scroll
  • 00:24:38 down security rules there of course the
  • 00:24:40 same for all infection yeah there's a
  • 00:24:42 lot of information about it with a lot
  • 00:24:45 of examples because super important to
  • 00:24:47 get that right obviously because always
  • 00:24:49 important you can't control it from your
  • 00:24:51 province you need to do this here and
  • 00:24:53 you have a very expressive language you
  • 00:24:55 need to get the grasp of it I guess
  • 00:24:57 because it is not super obvious how it
  • 00:25:00 works maybe at first look but it's super
  • 00:25:02 easy to get into the end yeah once you
  • 00:25:04 start saying that's just mimicking the
  • 00:25:05 structure of your data and put in my
  • 00:25:07 little JavaScript snippets in there it's
  • 00:25:08 it's pretty straightforward and
  • 00:25:10 realistically your rules don't have to
  • 00:25:12 get that complex if you do good
  • 00:25:13 client-side validation as long as you're
  • 00:25:15 enforcing who is writing where you'll be
  • 00:25:18 able to get a spot yeah that's that's
  • 00:25:19 important too because here in the
  • 00:25:20 Security section there are really
  • 00:25:22 complicated rules too which makes sense
  • 00:25:25 but oftentimes you doing me to go that
  • 00:25:28 yet a lot of times you don't have to
  • 00:25:30 yeah and India is the type of thing
  • 00:25:32 where if you really care about your
  • 00:25:33 schema or you think about malicious
  • 00:25:35 users like you could or if you really
  • 00:25:37 care about rendering right and you don't
  • 00:25:39 want a malicious user to break your UI
  • 00:25:41 you can also be smart on the UI side
  • 00:25:43 because there you can write some ugly
  • 00:25:44 dated
  • 00:25:45 I'm not going to write every valid rule
  • 00:25:47 to be completely perfect
  • 00:25:48 but when I get it back I'm just going to
  • 00:25:50 check it I'm going to be like does this
  • 00:25:52 make sense for what I'm trying to do and
  • 00:25:53 if it doesn't you throw it out and
  • 00:25:54 either delete the record from firebase
  • 00:25:56 or send you an alert and say hey someone
  • 00:25:59 did this you have a bunch of options but
  • 00:26:01 you don't need to dive super deep and
  • 00:26:03 divide into security rules to get a ton
  • 00:26:05 out of them but you should definitely
  • 00:26:06 invest enough to lock things down and
  • 00:26:09 understand what users you're writing
  • 00:26:10 wire yeah so that was good but just one
  • 00:26:14 last point notice here's we all have
  • 00:26:15 have children and child here I think
  • 00:26:18 these are many things you don't need
  • 00:26:20 that office we just set but it is
  • 00:26:22 important to know about them because
  • 00:26:23 right now we always considered rules
  • 00:26:25 where we only have a look at the node we
  • 00:26:28 were writing or reading we can also
  • 00:26:30 reach out to the parent Bill clicks on
  • 00:26:32 your condition is like to death life
  • 00:26:34 yeah for example you're on content you
  • 00:26:36 could check that it matched another
  • 00:26:37 field or you know like content or you
  • 00:26:41 know a timestamp matches another that I
  • 00:26:43 created and things like that where you
  • 00:26:45 rely on each other's data you can
  • 00:26:47 definitely do that and on the parent
  • 00:26:48 level you can also say I this parent is
  • 00:26:51 only valid if it has these children so
  • 00:26:53 it needs a content field it needs to use
  • 00:26:55 your ID field you can basically do the
  • 00:26:57 same as these validation rules on the
  • 00:26:59 parent and say okay this parent child
  • 00:27:01 has to be a string it has to be that
  • 00:27:02 it's a little cleaner to do it this way
  • 00:27:04 but you can definitely do that where
  • 00:27:06 you're like reaching out
  • 00:27:07 and you can affect control the entire
  • 00:27:08 database or not control it but access it
  • 00:27:11 from any rule so you could say okay you
  • 00:27:14 can right here if you're the right user
  • 00:27:17 or if they're an admin and you could
  • 00:27:19 have a table of admin users that just
  • 00:27:21 have you IDs like to true and when you
  • 00:27:24 go right go in your rule you can look up
  • 00:27:26 in that list and set up the Soraa you
  • 00:27:28 ID'd their ads and let them write so you
  • 00:27:30 get access to everything it's not just
  • 00:27:32 the field that's being written to that's
  • 00:27:34 super important to you and what did I
  • 00:27:35 guess
  • 00:27:36 gonna love tools to work with I want to
  • 00:27:38 say a big thank you to you we're walking
  • 00:27:40 up through that and giving us a little
  • 00:27:42 more well an introduction from someone
  • 00:27:45 who works on the product
  • 00:27:46 absolutely thanks for my hope everyone
  • 00:27:48 got something out I think I hope my
  • 00:27:51 genuine excitement for the product shows
  • 00:27:52 through kind of absolutely love them
  • 00:27:54 stuff if I read it sure does and I will
  • 00:27:56 also do some I'm religious about that
  • 00:27:57 where we dive into you how we use the
  • 00:27:59 SDK and so on so that all part of this
  • 00:28:01 series but we often see awesome this
  • 00:28:03 Custis yes thank you
  • 00:28:05 mm-hmm