Client doesn't have permission to access the desired data in Firebase

Question

I have a page that is calling addCheckin() method which is inside a controller. In the controller, I am trying to create a reference as follows:

var ref = firebase.database().ref("users/" + $scope.whichuser + "/meetings/" +$scope.whichmeeting + "/checkins");

$scope.whichuser and $scope.whichmeeting are the $routeParams that I am passing from another route. Here's my checkin controller-

myApp.controller("CheckinsController",
    ['$scope','$rootScope','$firebaseArray','$routeParams','$firebaseObject',
    function($scope,$rootScope,$firebaseArray,$routeParams,$firebaseObject){

        $scope.whichuser = $routeParams.uid;
        $scope.whichmeeting = $routeParams.mid;

        var ref = firebase.database().ref("users/" + $scope.whichuser + "/meetings/" +$scope.whichmeeting + "/checkins");

        $scope.addCheckin = function(){
            var checkinInfo = $firebaseArray(ref);
            var data={
                firstname:$scope.firstname,
                lastname:$scope.lastname,
                email:$scope.email,
                date:firebase.database.ServerValue.TIMESTAMP
            }

            checkinInfo.$add(data);
        }

}]);/*controller*/

There are two errors that I am getting here-

Error 1:

Error: permission_denied at /users/Vp2P1MqKm7ckXqV2Uy3OzTnn6bB3/meetings: Client doesn't have permission to access the desired data.

Error 2:

Error: permission_denied at /users/Vp2P1MqKm7ckXqV2Uy3OzTnn6bB3/meetings/-KT5tqMYKXsFssmcRLm6/checkins: Client doesn't have permission to access the desired data.

And this is what I am tring to achieve-

Solution 1

Go to Firebase console of your app

Select Database From Side Menu --> Select Rule From tabs above --> Update your rule like this

{
    "rules": {    
        ".read": true,
        ".write": true
    }
}

hope it solve your problem . thanks :)

Solution 2

Firebase project by default starts with Firestore as database.

This issue can happen if the application uses "Firebase Realtime Database" and permission for it are not configured. Read and write permission for Firebase Realtime Database should be explicitly granted.

To do so, in Firebase console, Database > Pick "Realtime Database" instead of "Firestore Beta" from the dropdown beside Database > Rules > Set

{
/* Visit https://firebase.google.com/docs/database/security to learn more about security rules. */
"rules": {
".read": true,
".write": true
}
}

Hope that help!

Solution 3

As all provided answers include a security issue where everyone could write / delete entries in your database, which for instance could cause extensive costs and or complete loss of data, when used in a bad way.

Of course you need to use firebase authentication features to use those rules, but preventing write access for anonymous should be default. The following rule provides read access to everyone while keeping security.

{
    "rules": {
        ".read": true,
        ".write": "auth.uid != null"
    }
}

Solution 4

None of these answers provide the most secure way to set up the Realtime Database.

• You don't want anyone to randomly access or write to your database
• Even if the user is authenticated, you don't want them to access other's data

This rule should address all the cases:

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Solution 5

In order to grant access to all authenticated users, go to database rules tab in firebase web console and copy/paste following rules:

{
   "rules": {
    ".read": "auth != null",
    ".write": "auth != null"    
    }
}

View more solutions