在Cloud Firestore规则中，request.auth.uid似乎始终为null [英] request.auth.uid seems to always be null in Cloud Firestore rules

问题描述

我必须在这里缺少一些真正的基本知识……但是，每当我致电Cloud Firestore数据库并且尝试建立任何类型的安全性规则时，它们总是会失败.

I must be missing something really basic here... but any time I make a call to my Cloud Firestore db and I try to institute any kind of rules for security, they always fail.

做类似

    match /users/{userId} {
      allow create, read, update: if true;
    }

可行，但是显然不能解决问题.但是，如果我进行任何其他形式的检查，例如所有类似

works, but it obviously defeats the point. However, if I do any kind of additional scrutiny, such as the go-to example in all the docs like

    match /users/{userId} {
      allow create, read, update: if request.auth.uid != null;
    }

每次都会失败.我在将客户端代码连接在一起时是否缺少明显的东西?

it fails every time. Am I missing something obvious in how I'm wiring together my client side code?

这是我的客户端代码，用于登录用户，然后调用数据库以捕获用户. (请注意，在我的数据库中，用户的密钥是通过电子邮件而不是uid)

Here's my client side code that logs the user in, and then makes a call to the db to grab a user. (Note that in my db the keys for the users are by email, not by uid)

// this is a snippet from the code where I log the user in
firebase.auth().signInWithEmailAndPassword(email, FIREBASE_USER_PASSWORD)
            .then(user => {
            // the user comes back successfully logged in, 
            // I grab its uid and add it to a preparedUser object that I've been building, 
            // then pass this user to my getFirestoreUserObject function
                preparedUser.uid = user.uid;
                getFirestoreUserObject({dispatch, user: preparedUser, navigate});
            })
            
// then the getFirestoreUserObject function:
// note that all the code below works fine when there are no security rules in place

const getFirestoreUserObject = ({dispatch, user, navigate}) => {
    const {name, email, imageUrl} = user;
    // if I ask for currentUser here, I get back my logged in user
    const currentUser = firebase.auth().currentUser;

    // email is defined correctly here as the user's email
    firebase.firestore().collection('users').doc(`${email}`)
        .get() // the request fails here due to insufficient permissions
        .then(doc => {
            if (doc.exists) {
                const currentUser = doc.data();

                getUserFavorites({dispatch, currentUser, navigate});
            } else {
                createUserInFirestore({dispatch, user, navigate});
            }
        })
};

有什么明显的我想念的东西吗?如果我通过firebase.auth()登录用户，然后在调用firebase.firestore()之后立即登录，那该不应该具有经过身份验证的用户的上下文?如果没有，该如何将其传递给Firestore调用?

Is there something obvious that I'm missing? If I log a user in via firebase.auth(), and then immediately after call firebase.firestore(), shouldn't that have the context of the auth'd user? If not, how do I pass it to the firestore call?

谢谢！

推荐答案

经过数周的搜索，firestore和auth都可以独立工作，但不能一起工作……这是最简单的事情.

After weeks of searching, and firestore and auth both working independently but not together... it was the most simple thing.

我使用的是Firebase 4.x，这是启动项目时的最新版本.然后，当我开始添加身份验证规则时，在firebase上发布了有关如何执行数据库规则的最新文档(开始时甚至都没有看过，但几个月后又准备好实现它们了) )是使用Firebase 5.y列出的.更新了我的package.json，安装了npm，一切都神奇地工作了:(

I was on firebase 4.x, which was the latest available when I started my project. Then, when I came around to adding auth rules, the latest published documentation on firebase for how to do the db rules (which I hadn't even looked at when I started, but came back to months later when I was ready to implement them) were listed using firebase 5.y. Updated my package.json, npm install, and everything magically worked :(

希望这可以帮助其他人...确保您至少使用的是版本5！

Hope this can help someone else... make sure you're on at least version 5!

这篇关于在Cloud Firestore规则中，request.auth.uid似乎始终为null的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！