Firebase电子邮件说我的实时数据库有不安全规则：解决方案
我停下来接收来自Firebase的电子邮件，告诉我我的实时数据库有不安全的规则。这是我设置的规则的开始：
{
"rules": {
"aaa":{
".read": "auth != null",
".write": "auth != null",
},
"bbb":{
".read": "auth != null",
".write": "auth != null",
},
//..... rest of the rules.
}
}
在此处“ AAA”和“ BBB”是我在Firebase实时数据库中使用的节点。因此，您应该提及所有人。
这个解决方案合适吗？
I've stopped to receive emails from Firebase telling me that my realtime database has insecure rules. Here is the beginning of the rules I have set:
{
"rules": {
"aaa":{
".read": "auth != null",
".write": "auth != null",
},
"bbb":{
".read": "auth != null",
".write": "auth != null",
},
//..... rest of the rules.
}
}
Here "aaa" and "bbb" are the nodes I use in my Firebase realtime databse. So you should mention all of yours.
Is this solution suitable?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的安全规则应仅 允许您的应用程序代码所做的工作，仅此而已。
因此，如果您的代码直接写入
AAA和/或bbb并写入所需的任何数据，则您的规则与之匹配。但是通常您的代码会编写特定结构的数据，在这种情况下，您应该使用验证规则来验证该结构。
另外：您的代码是否真的需要删除或替换整个
aaa和/或bbb节点？还是只需要附加新的儿童节点？因为现在，您的规则允许任何用户从应用程序中获取配置，然后进行firebase.database（）。ref（“ aaa”）。remove（）并擦除其下面的内容。同样：如果与您的应用程序所做的事情匹配，则规则与之匹配。但是...似乎不太可能。Your security rules should only allow what your application code does, and nothing more.
So if your code writes directly to
aaaand/orbbband writes whatever data it wants there, then your rules match that.But typically your code will write data of a specific structure, in which case you should validate that structure with validation rules.
Also: does your code really need to delete or replace the entire
aaaand/orbbbnode? Or does it only need to append new child nodes to it? Because right now, your rules allow any user to take the configuration from your application and then dofirebase.database().ref("aaa").remove()and wipe whatever is under it. Again: if that matches with what your application does, then the rules match that. But... it seem unlikely.始终尝试包括用户UID以获得更多安全性。
Always try to include User UID for more security.