firebase - Possibility for only currently connected (not authenticated) and admin user to read and write on certain location -

is there way write security rule or there other approach make possible connected (not authenticated) user write/read location - admin should able write/read? can rule written disallows users read of complete list of entries , let them read entry matches identifier passed client?

i'm trying exchange data between user , node.js application through firebase , data shouldn't able read or write else other user and/or admin.

i know 1 solution user requests auth token on server , uses authenticate on firebase , make possible write rule prevents reads , writes. however, i'm trying avoid user connecting server solution not first option.

this in way session based scenario not available in firebase have ideas solve kind of problem - if implemented before session management:

• maybe letting admin write /.info/ location observed client every change , can read active connection - if understood correctly how .info works
• maybe creating .temp location purpose
• maybe letting admin , connected client have more access connection information contain connection unique id, can used create location name , use inside rule prevent reading , listing other users

thanks

this seems classic xy problem (i.e. trying solve attempted solution instead of actual problem).

if understand constraints correctly, underlying issue not wish have direct connections server. model we're using firebase , can think of 2 simple patterns accomplish this.

1) store data in non-guessable path

create uuid or gid or, assuming we're not talking bank level security here, plain firebase id ( firebaseref.push().name() ). have server , client communicate via path.

this avoids need security rules since urls unguessable, or close enough it, in case of firebase id, normal uses.

client example:

var fb = new firebase(my_instance_url+'/connect'); var uniquepath = fb.push(); var myid = uniquepath.name();  // send message server uniquepath.push('hello world'); 

from server, monitor connect, each 1 connects new client:

var fb = new firebase(my_instance_url+'/connect'); fb.on('child_added', newclientconnected);  function newclientconnected(snapshot) {    snapshot.ref().on('child_added', function(ss) {        // when client sends me message, log , return "goodbye"        console.log('new message', ss.val());        ss.ref().set('goodbye');    }); }; 

in security rules:

{    "rules": {        // read/write false default         "connect": {           // contents cannot listed, no way find out ids other guessing            "$client": {              ".read": true,              ".write": true           }        }    } } 

2) use firebase authentication

instead of expending effort avoid authentication, use third party service, firebase's built-in auth, or singly (which supports firebase). best of both worlds, , model use cases.

your client can authenticate directly 1 of these services, never touching server, , authenticate firebase token, allowing security rules take effect.