Question 119313 in Firebase Question posted in
An extensive official documentation can be found here.

Firebase – How to pass Auth token in FireStore in Web app

I have developed a single crud project(Login screen and crud operation screen HTML) and hosted on firebase hosting. where User signing with email and password, I am using firebase signing with email and password and its working as expected.

But now issue is I want to secure backend with auth but its not passing auth in setDoc() deleteDoc() etc, My requirement is without auth. no one should do any operation on database.

import { doc, setDoc } from "firebase/firestore"; 
await setDoc(doc(db, "cities", "LA"), {
  name: "Los Angeles",
  state: "CA",
  country: "USA"
});

below rules are working but its not secured for production env. :

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true
    }
  }
}

If set rules like below it give me insufficient permission error. I don’t know how to pass UID in setDoc() or any operation.

allow read, write: if request.auth != null

Update : If i put below code before setDoc() below code is not executing because currentUser has user data.

function addCity(){

    if (!firebase.auth().currentUser) {
        // this code not executing because user is signed
        alert("Login required");
        window.href = "login.html";
        return;
    }
    // i can print UID and it is showing means user is logged.
    await setDoc(doc(db, "cities", "LA"), {
         name: "Los Angeles",
         state: "CA",
         country: "USA"
    });
}
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Finally, I found solution. I was using different version library of firebase. like I was using web v8 library for login and modular lib for database access. I just moved all firebase SDK to same version and modular.


  2. 0

    This is in detail covered in the Firebase documentation on Security & Rules, which I would recommend you to check out.You can secure your data with Security Rules,Firebase Security Rules are evaluated and based on that the rules language it is validated whether the current user can access your data.
    Security Rules give you access to a set of server variables to check your rules against. The most commonly used one is the auth variable which lets you check against the currently authenticated user. You can also create wildcard variables with the $, which acts as a route parameter creating.
    { "rules": { "users": { // users can read and write their own data, but no one else. "$uid": { ".read": "auth.uid == $uid", ".write": "auth.uid == $uid" } } } }

    You can also check the feature called Firebase App Check, it will let you limit access to your Realtime Database to only those coming from iOS, Android and Web apps that are registered in your Firebase project.
    You can combine this with the user authentication based security described above, so that you have another shield.
    Also check these similar examples below:

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search