in docs told rules cascade , children can't revoke privileges later in chat example root read , write rules default false,so why doesn't cascade? doc link
good question.
when rules cascade, read permissions cases. once have permission read node, cannot take permission away @ lower level.
so can start ".read": false
@ top-level , allow reads lower (snippet firebase documentation on security rules):
{ "rules": { ".read": false, "room_names": { // room names can enumerated , read // cannot modified since no write rule // explicitly allows ".read": true,
but opposite not work. cannot nobody allowed see specific room name once you've said every can see room names:
// snippet not work { "rules": { ".read": false, "room_names": { // room names can enumerated , read // cannot modified since no write rule // explicitly allows ".read": true, "my_secret_room": { // not work // since we've said every can read room names // cannot take permission away anymore ".read": false }
Comments
Post a Comment