I am encountering issues with implementing onDisconnect().remove() in conjunction with authentication/security rules. Here is what I have set up:
Initially, the user is logged in using auth():
var rootRef = new Firebase(FIREBASE_URL + 'sites/' + FIREBASE_ROOT);
rootRef.auth(user.FIREBASE_TOKEN, loginCallback);
The loginCallback then registers the current user as active and ensures that the user reference is removed on disconnection:
var activeUsers = $firebase(rootRef.child('pages/' + pageId + '/users')).$asArray();
var rawUser = {
id: user.id,
displayName: user.displayName
};
activeUsers.$add(rawUser).then(function (userRef) {
userRef.onDisconnect().remove();
});
The security rules for this specific part of my Firebase database are structured like this:
{
"rules": {
"sites": {
"$siteName": {
"pages": {
"$pageId": {
"users": {
// only users with firebase access can use this
".read": "auth.firebase_user === true"
"$arrayId": {
// users can only write their own data
".write": "auth.firebase_user === true && auth.id === newData.child('id').val()",
".validate": "newData.hasChildren(['id', 'displayName'])"
}
}
}
}
}
}
}
}
Despite having these security settings and JavaScript code, the user references are not being properly removed from Firebase on disconnection. However, when using these altered security rules instead, the removal functions correctly:
{
"rules": {
"sites": {
"$siteName": {
"pages": {
"$pageId": {
"users": {
// only users with firebase access can use this
".read": "auth.firebase_user === true",
".write": "true",
"$arrayId": {
// users can only write their own data
//".write": "auth.firebase_user === true && auth.id === newData.child('id').val()",
".validate": "newData.hasChildren(['id', 'displayName'])"
}
}
}
}
}
}
}
}
User references are successfully removed on disconnection with this setup.
I have experimented with various security rules and JavaScript implementations, but they all lead to the same issue.
Could there be a potential authentication problem here? Do the user's auth variables reach Firebase in time to remove the user correctly?
In addition, I am utilizing AngularFire for this implementation, which serves as a presence feature to display who else is viewing the current page.