保护壁垒规则

发布于 2025-01-23 10:56:24 字数 535 浏览 0 评论 0原文

我已经在Firebase实时数据库中编辑了规则，如下所示：

{
  "rules": {  
    "poyntkds": {
      "kdsOrderStatus": {
        "$uid":{
          ".read":"$uid === $uid",
          ".write":"$uid === $uid",  
        },
        ".indexOn": ["id", "forDate"]
      }
    }
  },   
}

我认为这样做，我只允许特定的商人（$ uid）可以访问/读取他的数据。但是，我仍然收到电子邮件，说壁炉规则并不安全。有没有更好的方法来改善我的数据库的安全性？

原文

I have edited the rules in my firebase real-time database as follows:

{
  "rules": {  
    "poyntkds": {
      "kdsOrderStatus": {
        "$uid":{
          ".read":"$uid === $uid",
          ".write":"$uid === $uid",  
        },
        ".indexOn": ["id", "forDate"]
      }
    }
  },   
}

I think by doing this I am allowing only the particular merchant($uid) to have access to write/read his data. But still, I am getting emails that the firebase rules are not secure. Is there a better way to improve the security for my database?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

影子的影子 2025-01-30 10:56:24

“ $ uid === $ uid”这将始终是正确的，因为它只能检查用户试图访问的数据的钥匙是否等于本身，因此它是不安全的。如果您试图检查该密钥是否与用户的UID相等，请尝试以下规则：

{
  "rules": {  
    "poyntkds": {
      "kdsOrderStatus": {
        "$uid":{
          ".read":"$uid === auth.uid",
          ".write":"$uid === auth.uid",  
        },
        ".indexOn": ["id", "forDate"]
      }
    }
  },   
}

这些规则将允许读/写时，仅当$ UID与用户的UID相同，因此是安全的。您可以在

"$uid === $uid" this will always be true because it just checks if the key of data a user is trying to access is equals to itself and hence it's insecure. If you are trying to check if that key is equal to user's UID then try the following rules:

{
  "rules": {  
    "poyntkds": {
      "kdsOrderStatus": {
        "$uid":{
          ".read":"$uid === auth.uid",
          ".write":"$uid === auth.uid",  
        },
        ".indexOn": ["id", "forDate"]
      }
    }
  },   
}

These rules will allow read/write only when $uid is same as user's UID and hence are secure. You can read more about security rules in the documentation.

回复收藏 0 原文

~没有更多了~