-1

How to check if user enters correct password to join a chat.

This approach is propably compeletely improper. This piece of code is just to show what I want to accomplish but it isn't working at all.

val ref = FirebaseDatabase.getInstance().getReference("chats")  

ref.child(chatName).child("password").equalTo(password).addListenerForSingleValueEvent(   
    override fun onDataChange(snapshot: DataSnapshot) {
        Log.d(TAG, snapshot.toString())
        // if there is data the password was right
    }
    ....
)

How can this whole join chat with password system be done securely? What kind of rules do I have to set to the database.

Is it possible to alter firebase queries with rooted phone and see the data that is transferred between client and the server?

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
Metu
  • 1,033
  • 1
  • 13
  • 20

1 Answers1

1

If you'd like to secure each chat room with a password, one option is to embed that password into the path of the chat room. So for example:

chats: {
  roomId1: {
    secret: {
      chat11: ...
      chat12: ...
    }
  }
  roomId2: {
    correcthorsebatterystaple: {
      chat21: ...
      chat22: ...
    }
  }

Secure this structure with the following rules:

{
  "rules": {
    ".read": false,
    "chats": {
      "$roomId": {
        "$password: {
          ".read": true
        }
      }
    }
  }
}

With this structure, nobody can read the list of rooms, or even a specific room. To be able to read they must know both the room Id and the password for that room.

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • How the password can be changed? – Metu Dec 22 '17 at 11:59
  • With this model you will have to move all the messages if you want to change the password. Since there is no operation to rename/move a branch, this will require that you copy then. See https://stackoverflow.com/questions/39107274/is-it-possible-to-rename-a-key-in-the-firebase-realtime-database – Frank van Puffelen Dec 22 '17 at 14:33
  • Then I am still searching for another way to do this. Thanks although. – Metu Dec 22 '17 at 15:51