Controlling Data Access Using Firebase Auth Custom Claims (Firecasts)

What people said

Recommends Jen Person · 2018-10 · Stack Overflow · on “Extending Firebase Users”

I have written a blog [LINK] and made a video [this video] on how you can use custom claims to assign roles to your users. Essentially, you apply custom claims on a secure backend like inside of Cloud Functions, and these can be used to control access to Firebase backend features like Cloud Firestore and the Realtime Database. You can also check out the Firebase guide [LINK] for more information. As for additional data about a user like gender and addresses, that should be stored in Cloud Firestore, the Realtime Database, or whatever database you choose to use. It is not information that you constantly need when accessing a User object.

Recommends Jen Person · 2018-11 · Stack Overflow · on “How to create a admin state in react using firebase?”

As Eric points out, this method works if you have one user who is an administrator, but keep in mind it's not secure. If someone could take apart the app, they could find that code and easily get around it. If your purpose is simply to hide a tab for a better user experience, then that works fine. Instead, I'd recommend controlling access via custom claims. I made a video about it that you can check out here [this video] . There's also a blog post [LINK] , a codelab [LINK] , and a getting started guide in the documentation [LINK] . An example from the guide can give you an idea of how this looks in JS: firebase.auth().currentUser.getIdTokenResult() .then((idTokenResult) => { // Confirm the user i

Recommends Gregg · 2019-02 · Stack Overflow · on “Firestore Security: Deny Update / Write If Field In Request Resource (Works in simulator, not IRL)”

Two other things you could consider doing for adding permission levels: Create a separate subcollection for the user that will then contain a document with information you do not want the user to be able to change. That document can be given different permission controls. Use Firebase Auth Tokens with Custom Claims . Bonus: this method will not trigger reads on the database. I recommend checking out these Firecasts: Controlling Data Access Using Firebase Auth Custom Claims [this video] Minting Custom Tokens with the Admin SDK for Java [LINK] Add the Firebase Admin SDK to Your Server [LINK] guide is also very helpful. I am new to the development game, but this what I use to manually create custom

Recommends trevren11 · 2019-07 · Stack Overflow · on “How to share data between users in Firebase?”

This video is helpful: [this video] The general idea is the same, instead of isTeacher == true, just add them to the roles of another user (for example userX { usersWithViewAccess : userY, userZ ... } ) service cloud.firestore { match /databases/{database}/documents { match /class/ {classId}/grades/{studentId} { allow read: if request.auth.uid == studentld; allow write: if get(/databases/$(database)/documents/ administrators/$( request. auth.uid)).data.isTeacher == true; } } } With this as the rules administrators: { userid123: { isTeacher : true } userid009: { isAdminAssistant : true } }

Recommends Mucyo Fred · 2019-07 · Stack Overflow · on “Backend for flutter”

What you want to achieve It likes to implement role-based access control (RBAC) with firebase checks this [this video]

Recommends Josh Pittman · 2019-12 · Stack Overflow · on “Letting different types of users use different aspects of my firebase app”

The way to do this is to implement role-based user authorization and security rules by adding custom claims to the Firebase Auth ID token. Here are some resources to get you started: [this video] [LINK]

Recommends DDevil · 2022-08 · Stack Overflow · on “How can i seperate two types of users in firebase to seperate the login of web and mobile app users”

Firebase Auth is about authentication (are you the person you said you are). Your need is more about Access Control. There is a feature in Firebase that may help with that. It's called "custom claims" and allow you to perform Claim-Based Access control. see this video: [this video]

Cites Frank van Puffelen · 2019-01 · Stack Overflow · on “how to make singups and signins with different group of users”

Storing this information in the user's display name can work. You can read it back from there next time, and take action in your application's client-side code. But note that this means that any user can change their role, since they can also call the same code to update their profile [LINK] . If that is not a concern for your app, then this approach sounds like it would work. If malicious users should not be able to change their role, then you shouldn't set that role from the client-side application code. In that case, you can set the role from a server (or your development machine, or Cloud Functions) using the Admin SDK. Since the Admin SDK runs in a trusted environment, it has expanded p

Cites cbdeveloper · 2019-02 · Stack Overflow · on “How to get users from Firebase auth based on custom claims?”

Because from what I understood that would make my Firestore security rules much more complex. See This video [this video] . I would have to read from another place (like the one you suggested) in my database before allowing a read/write operation on some protected data.

Cites salah3x · 2019-03 · Stack Overflow · on “Firebase Auth Custom claims not propagating to client”

The client sdk is caching the old token (old claims). You should add a mechanism to refresh it after changing the claims (eg. push notification) or just wait for the old token to expires or user to lougout and login again. It's explained here [this video] Edit You can force the sdk to refresh the token using firebase.auth().currentUser.getIdToken(true)