在 Firebase 数据库中创建节点后如何阻止访问更改？

Question

我有以下情况，如果节点已经存在，我如何拒绝访问更新（覆盖）？比如请求加好友，我想要那个，这个功能执行了一次，因为在数据库里面设置了规则，但是没有用。如何解决？

规则

// friends 
      "friends": {
        "$ownerID": {
          "friendIncomingRequests": {
            "$secondUserID": {
              ".write": "!data.exists()" // Only allow new nominations to be created
            }
          },
          "friendOutgoingRequests": {
             "$secondUserID": {
              ".write": "!data.exists()" // Only allow new nominations to be created
            }
          }
        }
      }

数据

  "friends" : {
    "8OdvaGQfMVdJrlCxdc5pOaj09hy2" : {
      "friendOutgoingRequests" : {
        "mp9pfsfVQKavwYddjYYPC5Ja9N93" : {
          "timeStamp" : 1.495514876872129E9,
          "userID" : "mp9pfsfVQKavwYddjYYPC5Ja9N93",
          "userName" : "Tim C."
        }
      }
    },
    "mp9pfsfVQKavwYddjYYPC5Ja9N93" : {
      "friendIncomingRequests" : {
        "8OdvaGQfMVdJrlCxdc5pOaj09hy2" : {
          "senderID" : "8OdvaGQfMVdJrlCxdc5pOaj09hy2",
          "senderName" : "Alexsander K.",
          "timeStamp" : 1.495514876872129E9
        }
      }
    }
  },

更新我认为问题出在这段代码中，因为我在规则中也有这段代码。但是我该如何解决呢？

"rules": {
    ".read": "auth != null",
    ".write": "auth != null",
 }

更新 1：这里是所有规则。我只需要在朋友中制定特定的写入规则（更新）。我看到了针对他们规则的每个单独分支的示例，但是如果我需要为一个分支做一些特定的规则，而对于数据库的其余部分您需要标准规则，我应该如何做得更好？

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null",



      // card location
    "cardLocation": {
      // Allow anyone to read the GeoFire index
      //".read": true,
      // Index each location's geohash for faster querying
         ".indexOn": "g",

     },

      "cards": {
        ".indexOn": "ownerID"
      },

      "userListEvents": {
          "$uid": {
            ".indexOn": "isConfirmed"
          }
      },

      "userImages": {
        "$uid": {
          "userProfileImages": {
                            ".indexOn": "isoDate"
          }
        }
      },

      // tags 
      "userTags": {
        "$uid": {
          ".indexOn": "isSelected"
        }
      },


        // people search
        // 
        "userLocations": {
          ".indexOn": "g"
        },


      // friends 
      "friends": {
        "$ownerID": {
          "friendIncomingRequests": {
            "$secondUserID": {
              ".write": "!data.exists()" 
            }
          },
          "friendOutgoingRequests": {
             "$secondUserID": {
              ".write": "!data.exists()" 
            }
          }
        }
      }

  }
}

Answer 1

I think the problem is in this code, since I have this code also in the rules. But how can I fix it?

"rules": {
    ".read": "auth != null",
    ".write": "auth != null",
 }

是的，你的想法是正确的。 Firebase .read 和 .write 规则级联。因此，您应该将每个 .read 和 .write 放在数据结构的每个子节点上。类似的东西：

{
  "rules": {
  //skip this
    "someNode": {
        ".read": "auth != null",
        ".write": "auth != null"
    },
    // friends 
    "friends": {
      "$ownerID": {
        "friendIncomingRequests": {
          "$secondUserID": {
           ".write": "!data.exists()" 
        }
      },
        "friendOutgoingRequests": {
          "$secondUserID": {
            ".write": "!data.exists()" 
          }
        }
      }
    }
    //...
  }
}

在 Firebase 数据库中创建节点后如何阻止访问更改？

How do I prevent access to changes after creating a node in Firebase Database?

ios

firebase

firebase-security

firebase-realtime-database