【发布时间】:2018-05-16 13:11:27
【问题描述】:
我正在尝试编写应用程序,但我遇到了一些我无法解决的安全问题,我需要帮助。 我在 firebase 上使用用户电话身份验证,它工作正常。现在我想当用户 auth 被授予用户 id 保存在数据库中并且它正在工作时。
但问题是我使用此代码为新用户写入数据库的规则:
{
"rules": {
".write": "auth == null ",
".read": "auth == null "
}
}
此代码用于新用户注册时:
FirebaseUser user = FirebaseAuth.getInstance().getCurrentUser();
Firebase Ref = new Firebase( "database address" );
Firebase usersRef = Ref.child( "Users" ).child( "user_id" );
usersRef.setValue( user.getUid() );
当我使用此规则时,身份验证被拒绝:
{
"rules": {
".write": "auth != null ",
".read": "auth != null "
}
}
但是我的用户已经注册了,我得到了他的 id 和电话表单 Authentication user 我该如何解决这个安全问题?
D/FirebaseAuth: Notifying id token listeners about user ( b3bizXzmH7XQfXWNvHCMVXzDHSx2 ).
D/FirebaseApp: Notifying auth state listeners.
D/FirebaseApp: Notified 0 auth state listeners.
D/PhoneAuthActivity: signInWithCredential:success
D/FirebaseAuth: Notifying id token listeners about user ( b3bizXzmH7XQfXWNvHCMVXzDHSx2 ).
D/FirebaseApp: Notifying auth state listeners.
Notified 0 auth state listeners.
D/PhoneAuthActivity: signInWithCredential:success
W/RepoOperation: setValue at /Users/user_id failed: FirebaseError: Permission denied
W/RepoOperation: setValue at /Users/user_id failed: FirebaseError: Permission denied
D/FirebaseAuth: Notifying id token listeners about user ( b3bizXzmH7XQfXWNvHCMVXzDHSx2 ).
D/FirebaseApp: Notifying auth state listeners.
D/FirebaseApp: Notified 0 auth state listeners.
D/PhoneAuthActivity: signInWithCredential:success
W/RepoOperation: setValue at /Users/user_id failed: FirebaseError: Permission denied
【问题讨论】:
标签: android firebase firebase-realtime-database firebase-authentication