同一子项中数据的 Firebase 安全规则

Question

我的数据库结构是。

Homeland
 +Ui4PSHU0kCPGpFJ6jWIJPOdLvEds
  +service
  +quta
  +period
+55dwaSHU0kCPGpFJ6jWIJPOdLvEds
  +service
  +quta
  +period

我想公开“服务”和“quta”孩子，但只有注册用户才能显示“句号”孩子。但是我的用户目录存在问题。

首先我想测试我的 $uid 是否可以。但我不能。当我删除到 $uid 时它可以工作，只使用“Homeland”。所以它没有工作

{
  "rules": {
    "Homeland": {
         "$uid" : {
           ".read": true,
    ".write": "auth !== null"
         },
        },
    ".read": "auth !== null",
    ".write": "auth !== null"
  }
}

这是工作

{
  "rules": {
    "Homeland": {
           ".read": true,
    ".write": "auth !== null"
        },
    ".read": "auth !== null",
    ".write": "auth !== null"
  }
}

更新

按照 samthecodingman 所述更改我的安全规则。

{
  "rules": {
    "Homeland": {
      "$uid" : {
        "service": {
          ".read": true, // <-- publically readable
          ".write": "auth.uid === $uid" // <-- writable only by owner
        },
        "quta": {
          ".read": true, // <-- publically readable
          ".write": "auth.uid === $uid" // <-- writable only by owner
        },
        "period": {
          ".read": "auth !== null", // <-- readable by any logged in user
          ".write": "auth.uid === $uid" // <-- writable only by owner
        }
      },
    },
    "$other": { // <-- everywhere else not named above
      ".read": "auth !== null", // <-- allows read if logged in
      ".write": "auth !== null" // <-- allows write if logged in
    }
  }
}

代码

var kullanici = firebase.database().ref().child("Homeland").child(uservaluefrominput).child("service");
kullanici.on('value' ,function(datasnapshot) {


     sifre = datasnapshot.val();

     console.log(sifre);



});

但是代码和模拟都被拒绝读取值。

抓住错误。注意：这次我声明了用户标识。

try {

kullanici = firebase.database().ref().child("Homeland").child("Ui4PSHU0kCPGpFJ6jWIJPOdLvEO2").child("service");
kullanici.on('value' ,function(datasnapshot) {


     sifre = datasnapshot.val();

     console.log(sifre);



});

} catch (someError) {
  console.log('got some error: ', someError);
}

Answer 1

需要注意的是database rules cascade。即使您拒绝$uid 以外的任何人访问/users/$uid，但允许任何人访问/users/，任何人都可以修改更深的位置/users/$uid。

在上面的规则中，即使您为/Homeland/$uid 配置了规则，您也允许任何登录用户对根数据库进行读/写访问。

{
  "rules": {
    "Homeland": {
      "$uid" : {
        ".read": true,
        ".write": "auth !== null"
      },
    },
    ".read": "auth !== null", // <-- allows read everywhere if logged in
    ".write": "auth !== null" // <-- allows write everywhere if logged in
  }
}

要解决此问题，您可以引入$others 键，以便登录用户可以读取/写入数据库中除/Homeland 之外的任何位置，除非另有允许。

{
  "rules": {
    "Homeland": {
      "$uid" : {
        ".read": true,
        ".write": "auth !== null"
      },
    },
    "$other": { // <-- everywhere else not named above
      ".read": "auth !== null", // <-- allows read if logged in
      ".write": "auth !== null" // <-- allows write if logged in
    }
  }
}

下一步是在/Homeland/$uid 键下限制对/service、/quta 和/period 的访问。

{
  "rules": {
    "Homeland": {
      "$uid" : {
        "service": {
          ".read": true, // <-- publically readable
          ".write": "auth.uid === $uid" // <-- writable only by owner
        },
        "quta": {
          ".read": true, // <-- publically readable
          ".write": "auth.uid === $uid" // <-- writable only by owner
        },
        "period": {
          ".read": "auth !== null", // <-- readable by any logged in user
          ".write": "auth.uid === $uid" // <-- writable only by owner
        }
      },
    },
    "$other": { // <-- everywhere else not named above
      ".read": "auth !== null", // <-- allows read if logged in
      ".write": "auth !== null" // <-- allows write if logged in
    }
  }
}

但是，由于/Homeland 下的混合权限级别，您会受到可以对此数据执行的查询的限制。例如，您不能只使用查询列出/Homeland 下的所有用户，因为读取操作将被拒绝。

一个不起作用的查询是：

firebase.database().ref('/Homeland').on('child_added', (snap) => { ... })`

要以尽可能简单的方式解决此问题，您可以根据谁可以访问数据将/Homeland 拆分为/HomelandPublic 和/HomelandRegistered。其规则类似于：

{
  "rules": {
    "HomelandPublic": {
      "$uid" : {
        ".write": "auth.uid === $uid" // <-- writable only by owner
      },
      ".read": true // <-- publically readable
    },
    "HomelandRegistered": {
      "$uid" : {
        ".write": "auth.uid === $uid" // <-- writable only by owner
      },
      ".read": "auth !== null" // <-- readable by any logged in user
    },
    "$other": { // <-- everywhere else not named above
      ".read": "auth !== null", // <-- allows read if logged in
      ".write": "auth !== null" // <-- allows write if logged in
    }
  }
}

之前的查询现在将更改为：

// get publicly accessible data
firebase.database().ref('/HomelandPublic').on('child_added', (snap) => { ... }) // alternatively: once('value', (snap) => {})

// get data accessible by registered users
if (firebase.auth().currentUser) {
  firebase.database().ref('/HomelandRegistered').on('child_added', (snap) => { ... }) // alternatively: once('value', (snap) => {})
}

这应该会给你足够的知识来适应你的情况和需要。