In this lecture, we are going to make a minor modification to our rules in Firebase.
Currently, I'm in the rules section for the Firestorm database.
Pause the video if you need to navigate to this page as it stands.
Anyone is allowed to interact with the database.
They can edit, add or delete data from our database.
There are no restrictions in place.
We should start curating our rules to be more secure.
It's dangerous to allow anyone to have this much power.
We're going to add some restrictions to the writing rules.
Nested deeply inside the rules, the same condition is being used for reading and write permissions.
We can create different conditions for each case.
For Reading will allow anyone to view the data for writing.
Will restrict permissions to authenticated users only.
We're going to completely empty out the block.
Next, add the following allow read, if true.
Allow, right.
If request walked off, you did.
Exclamation point equals null.
The first condition will allow anyone to read the database.
We aren't going to store sensitive data such as passwords.
It's all right if the data is accessible.
As for the writing permission or using an object called request, we don't need to import this object.
Firebase will define this object for you.
We can use it to learn more about the user who's trying to access the database.
If we have the authentication service turned on, Firebase will add their authentication status to this
object.
In the resource section of this lecture, I provide a link to the authentication object.
According to the documentation, every authentication object will come with a UID and token in property.
The one we're using is called UID.
If the user is not authenticated, this property will be set to null back on the rules page.
We're checking if the UID property is not equal to know if this condition returns true.
The user will be able to write to the database.
Otherwise, they'll be denied access.
We're going to publish the rules before doing so.
Make your rules match mine.
We're finished with modifying the rules in the following lecture will begin authenticating the user
into the application.