Ways to verify the email address within Firebase's security rules

Question

Ways to verify the email address within Firebase's security rules

I have been securely storing user data using a unique reference ID and their email address. I want to ensure that only authorized users can access this information by requiring them to provide both the ID and the registered email address.

In Firebase, the data is structured as follows:

{ "data" : {
   "ms12345678" : { 
       "name" : "John Doe",
       "age"  : 40,
       "email" : "<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="92f8fdfafcf6fdf7d2f6fdfff3fbfcbcf1fdff">[email protected]</a>"
    }
}

Attempting

var ref = firebase.database().ref("data/ms12345678")

will only succeed if accompanied by

<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="9cf6f3f4f2f8f3f9dcf8f3f1fdf5f2b2fff3f1">[email protected]</a>

.

I am considering different options for ensuring data security without requiring user authentication but providing them with a secure link.

javascript firebase firebase-realtime-database firebase-security

Answer 1

Answer №1

To confirm that the accounts email address matches a certain value, you can use the following code snippet:

{
  "rules": {
    "data": {
      "$uid": {
        ".read": "auth.token.email === data.child('email').val()"
      }
    }
  }
}

For a list of available properties, refer to the documentation on auth.token.

Alternatively, you can enforce that the user must be familiar with the email address. This can be achieved by embedding the email address into the path of a user object:

{ "data" : {
   "ms12345678" : { 
      "johndoe@domain,com": {
         "name" : "John Doe",
         "age"  : 40,
         "email" : "<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="274d484f494348426743484a464e490944484a">[email protected]</a>"
      }
   }
}

This allows you to limit read access to individuals who know the complete path:

{
  "rules": {
    "data": {
      "$uid": {
        "$email: {
          ".read": "auth.uid === $uid"
        }
      }
    }
  }
}

Answer 2

To confirm that the accounts email address matches a certain value, you can use the following code snippet:

{
  "rules": {
    "data": {
      "$uid": {
        ".read": "auth.token.email === data.child('email').val()"
      }
    }
  }
}

For a list of available properties, refer to the documentation on auth.token.

Alternatively, you can enforce that the user must be familiar with the email address. This can be achieved by embedding the email address into the path of a user object:

{ "data" : {
   "ms12345678" : { 
      "johndoe@domain,com": {
         "name" : "John Doe",
         "age"  : 40,
         "email" : "<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="274d484f494348426743484a464e490944484a">[email protected]</a>"
      }
   }
}

This allows you to limit read access to individuals who know the complete path:

{
  "rules": {
    "data": {
      "$uid": {
        "$email: {
          ".read": "auth.uid === $uid"
        }
      }
    }
  }
}

Ways to verify the email address within Firebase's security rules

Answer №1

Similar questions

Troubleshooting: jQuery script encountering issues with loading Bodymovin JSON files

Is it possible to generate multiple modal windows with similar designs but varying content?

Can you explain the distinction between App: React.FunctionComponent and App = (): React.FunctionComponent()?

Cause: Trying to serialize an `object` that is not JSON serializable (such as a "[object Date]"). Ensure that only JSON serializable data types are returned

Parsing Firebase Realtime Database JSON with PHP

Creating a custom drag and drop page builder from the ground up

What sets $emit and $dispatch apart in Vue.js?

The age calculator is failing to display the accurate age calculation

Save pictures in an array and showcase them in an angular interface

Automatically add a class to the current list item in jQuery and remove the class from the

Cache items in a list that require a callback function

What is the most effective way to transform values into different values using TypeScript?

Creating a 10-digit unique value can be achieved with either meteor or JavaScript

How can you display a border around a <td> element in an HTML table only when it contains data, using jQuery or JavaScript?

Using JavaScript to Parse JSON Data Retrieved from an AJAX Call

Nativescript apps are unable to utilize Node modules

Combining 2 dates into a single cell format

Unraveling in jQuery

Alter color upon click using jQuery

Halt the script if the file has not been successfully loaded