1

I have User which has a username, UID, email so I want the email field and UID cant reached because some users don't want to spam their email by reading its email child and in my app register to search Users is not required How can work with this problem?

I thought to make a tree that no one can read/write except the Firebase but it doesn't exist in the Firebase

EDIT

{
  "bdjsjd" : {
    "email" : "something1@gmail.com",
    "name" : "bdbsndnd",
    "username" : "bdjsjd"
  },
  "developer" : {
    "email" : "something2@gmail.com",
    "name" : "dev_mohammed",
    "username" : "developer"
  }
}

when I want to read this by key(the key is user's username)it will return the email as well but I want to return everything except the email field if the user doesn't want to get the email by anyone else him but can I do this?

Mohammed
  • 55
  • 1
  • 8
  • There's not enough information here to effectively answer. What Firebase Database are you using (there are two: Cloud Firestore, and Realtime Database)? Can you show some code of the read operation you are trying to allow, and one you're trying to disallow? Can you show what you already tried to block the disallowed reads? – Frank van Puffelen Aug 31 '19 at 14:11
  • @FrankvanPuffelen thanks I added the JSON and what exactly I want and at the last, I use Firebase RealtimeDataBase – Mohammed Aug 31 '19 at 17:38

1 Answers1

0

Firebase will always returns complete nodes. So you can allow reading of each user's email and name nodes, and not of username. But if you allow reading of the user node (one level higher), there is no way to then exclude the username from the results.

To allow securing such a structure, you'll need to put the usernames in a different top-level node from the other details. Something like:

"profiles": {
  "bdjsjd" : {
    "email" : "something1@gmail.com",
    "name" : "bdbsndnd"
  },
  "developer" : {
    "email" : "something2@gmail.com",
    "name" : "dev_mohammed"
  }
},
"user_names": {
  "bdjsjd": "bdjsjd",
  "developer" : "developer"
}

Now you can give different permissions on /profiles and on /user_names.

Also see:

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • thanks, I know I can't but I want to secure database from the reverse engineering that secure the nodes but I think it is not as that dangerous as I think...thanks a lot:) – Mohammed Sep 01 '19 at 17:58