Firebase Realtime Database xxxx-xxxx-4458' has insecure rules - Followup Question

Question

I previously asked question to secure realtime database on firebase. I am only using Firebase Realtime database just to creating chat app. The user verification working separately on our own server and we are not using any firebase auth service for user verification. As Frank van Puffelen suggested few official docs. I am now generating JWT to authorize as per documentation but as we are not using any other services of firebase i am not sure how to authorized the real time database with generated JWT.

mAuth.signInWithCustomToken(mCustomToken)
    .addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
        @Override
        public void onComplete(@NonNull Task<AuthResult> task) {
            if (task.isSuccessful()) {
                // Sign in success

            } else {
                // If sign in fails
                Toast.makeText(CustomAuthActivity.this, "Authentication failed.",
            }
        }
    });

How to validate users and secure our database from world so only app user can edit their node only.

I followed this guide for Authenticate with Firebase with custom token.

• User login with their credential
• Server generate custom token (JWT).
• Pass it to signInWithCustomToken as per doc.
• What after that? guide bit incomplete for my use case.

---

Edit: The process:

Server generates JWT With PHP Firebase JWT

   $Token = JWT::encode($request_data,$secret_Key,'HS512');

this token return back to app if user login successfully.

After successfully user login i call sign in with custom token i received from server with firebase

firebaseAuth = FirebaseAuth.getInstance();
       firebaseAuth.signInWithCustomToken(Session.getJWT())
    .addOnCompleteListener(new OnCompleteListener<AuthResult>() {
        @Override
        public void onComplete(@NonNull Task<AuthResult> task)    {             
        if (task.isComplete()){
            Intent intent=new Intent(getActivity(),MainActivity.class);
            getActivity().startActivity(intent); 
            }           
        }   
    });

When user click chat button. Check if room already exist or not if not then create one for 2 users with their phone numbers like 9810012345-9810012346

    DatabaseReference db = rebaseDatabase.getInstance().getReference();
      
      
      db.addListenerForSingleValueEvent(new ValueEventListener() {
            @Override
            public void onDataChange(DataSnapshot dataSnapshot) {
                if (dataSnapshot.hasChild(RoomTitle)) {
                    RoomName(RoomTitle, true);
                }else {
                    RoomName(RoomTitle, false);
                }
            }
    
            @Override
            public void onCancelled(DatabaseError databaseError) {
            }
        });

public void RoomName(String Name, boolean RoomExist) {
    button_SendMessage.setEnabled(true);
    if (!RoomExist) {
        Log.d(TAG, "Room Not Exist Creating One);
        RoomName.put(Name, "");
        FireBaseDatabase.updateChildren(RoomName);
    }

        // Launch Chat Screen

}

Then on chat screen i add items like linked question database structure

databaseReference = FirebaseDatabase.getInstance().getReference().child(Room_Name);

So creating room,allow reading writing message only created room, block access if room doesn't belong to users. I need to set rules for Realtime Database and only app users can access their rooms not others even they are app users(Block others app users to sneak into others users rooms) Below is the sample of our Realtime Database structure for better understanding how our 2 user room look like. I am not sure there is much thing to do on app side, i feel it's more database than app code question.

Answer 1

Once your call to signInWithCustomToken succeeds, that token will be passed to the server whenever the Firebase Realtime Database SDK connects, and from there on it will be verified and passed on to the auth variable in your security rules.

So you can check if the request comes from a signed-in user with:

{
  "rules": {
    ".read": "auth.uid !== null",
    ".write": "auth.uid !== null"
  }
}

That's a bit broad though, so you'll want to narrow it down to specific users. For example, you can allow only a content-owner access with:

{
  "rules": {
    "some_path": {
      "$uid": {
        // Allow only authenticated content owners access to their data
        ".read": "auth !== null && auth.uid === $uid",
        ".write": "auth !== null && auth.uid === $uid"
      }
    }
  }
}

Any claims you have in your JWT will be available in the security rules too under the auth.token variable.