在firebase中删除用户不会触发onAuth方法 [英] Deletion of User in firebase does not trigger onAuth method

问题描述

当用户通过登录和注册用户的注册用户部分删除时， Auth Firebase Web界面，onAuth方法不会被触发，用户仍然登录并能够写入数据库。如何确保用户的会话被销毁，然后用户被删除？

解决方案

安全规则。

当用户被删除时，他们不会立即未经身份验证。但是，您可以编写安全规则，以保护不再存在的用户的私人数据。

以下数据为例。

$ b $ private
$ private $只有经过身份验证的用户才可以阅读我！
users：{
user1：Alice，
user2：Bob
}
}
}

在这种情况下，我们只希望 / users 列表中的用户可以访问 / privateData location。一个简单的 auth！= null 将会起作用，直到其中一个用户被移除。

  {
rules：{
privateData：{
.read：auth！= null& &安培; auth.uid == root.child（'users'）。child（auth.uid）.exists（），
.write：auth！= null&& auth.uid == root.child（'users'）。child（auth.uid）.exists（）
} 
} 
} 
  

上面的规则不仅检查已验证的用户，还检查用户是否存在于 / users location。

令牌将会过期，他们将不能再登录，但是通过强大的安全规则，你可以保证他们不再有权限到任何数据。

When a user is deleted via the Registered Users section of the Login & Auth firebase web interface, the onAuth method is not triggered and the user remains logged in and able to write to database. How can one ensure that the user's session is destroyed then the user is deleted?

解决方案

Security rules.

When a user is deleted they are not immediately unauthenticated. However, you can write your security rules in a way that protects private data from users who no longer exist.

Take the following data for example.

{
  "privateData": "only authenticated and existing users can read me!,
    "users": {
      "user1": "Alice",
      "user2": "Bob"
    }
  }
}

In this situation we only want users in the /users list to have access to the /privateData location. A simple auth != null would work, until one of the users is removed.

{
   "rules": {
     "privateData": {
        ".read": "auth != null && auth.uid == root.child('users').child(auth.uid).exists()",
        ".write": "auth != null && auth.uid == root.child('users').child(auth.uid).exists()"
     }
   }
}

The rules above not only check for an authenticated user, but they also check that the user exists in the /users location.

The token will expire and they will no longer be able to login. But with robust security rules you can guarantee they have no longer have access to any data.

这篇关于在firebase中删除用户不会触发onAuth方法的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！