In this lecture, we're going to modify our fire based rules for production.
We've overlooked some of the rules during the development phase of our application.
The database rules in Firebase are not entirely secure at the moment.
Any user who is authenticated can modify the documents in the database.
This includes documents that don't belong to them.
Let's fix this.
Open the Firebase console in your browser.
Navigate to the rules page for the database.
We have two rules, one for Reading and another for writing, the rule for reading the database is fine,
as is.
We aren't storing anything super sensitive in the database.
The writing rule needs to be changed.
We want to create rules for when we write, create or delete documents from the database.
We can create special rules for each of these scenarios.
By default, Firebase will use the writing rules for all three scenarios.
However, it's not the best way to write our rules.
Currently, the rules are checking if the user is authenticated.
If they are, they will be allowed to edit any document.
We should restrict their editing capabilities to documents they own.
We're going to change this rule to the following if request not asked UID equals equals resource dot
data dot uid.
The resource object refers to the document the client is attempting to access.
It has information about the document.
We can access the data with the data property.
Through this object, we can access any of the values in the document.
The condition we're writing checks.
If the ID on the client matches the ID in the document, we assign the user ID to the ID property.
If the client attempts to write to a document they're not the owner of, the request will be rejected.
This is a much more secure way to limit writing permissions.
There is one problem with the rule it will be applied to creating documents in this collection.
We can't obtain an ID from the document if it doesn't exist to begin with.
We still want to be able to create documents, but this rule will reject us.
We'll create a rule specifically for creating documents below.
This rule will add the following allow, create call in if request walked off.
Exclamation point equals null.
This rule is the same rule we had before, we're going to allow any authenticated user to create a document.
There is one less rule well, right, if users attempt to delete a document, they'll be rejected because
we haven't covered that scenario in our rules.
We'll add the following to the rules Allow delete colon.
If Request Dot off dot uid equals equals resource that data uid.
The rule for deleting documents is the same as the rule for writing documents.
We want to limit what documents the user can delete by making sure they own the document they're trying
to delete.
We're finished with writing the rules for the database.
Let's publish them.
We're not going to modify the storage rules.
They are fine, as is Firebase is ready for production.
So let's move on to deploying the app in the next lecture.