# Firebase rules for secure access without sign-in? **URL:** \ **Category:** Questions about Thunkable X\ **Tags:** firebase\ **Created:** [November 21, 2021, 5:25am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508 "2021-11-21T05:25:55Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 5:25am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/1 "2021-11-21T05:25:55Z")
I know this is slightly off-topic but I’m hoping someone can help. I want users to be able to read/write data from Firebase without having to sign in using an email address. For my meal planning app, I’d like to generate a random User ID (I’ve already done that) and then have the app sync to the Firebase node with that value. That’s working fine with the test rules that Firebase sets by default (which are wide open). How do I change them to protect users more? Here’s my Firebase structure: ![Screen Shot 2021-11-20 at 9.21.09 PM](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/e/d/ede47b09765be2e739c708fdf7b180733211965b.png) I’m saving the User ID (e.g. `3362-6163-7471-6933-91`) in a Stored variable on the device. So when the app loads, it uses that same User ID every time. But how do I ensure that that particular user has access to **only** that node, in this case `/Users/3362-6163-7471-6933-91/` and not all of `/Users/`? It looks like this might be a good place for me to start… not sure: [https://firebase.google.com/docs/rules/basics#attribute-based\_and\_role-based\_access](https://firebase.google.com/docs/rules/basics#attribute-based_and_role-based_access) ---
**Author:** ![tony.ycy.program](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tony.ycy.program/32/100153_2.png) [@tony.ycy.program](https://community.thunkable.com/u/tony.ycy.program)\ **Post date:** [November 21, 2021, 5:35am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/2 "2021-11-21T05:35:32Z")
I know there is a way to: Use the login function the same, but you need some settings. Device variable of an ID: Randomly generated for the first use. (You also need to register by the way: “you have a Gmail [account+ID@gmail.com](mailto:account+ID@gmail.com)” will become a non-fake email. Password device variable. For example:if you have a [Gmail:"abcdapp@gmail.com](mailto:Gmail:%22abcdapp@gmail.com)" and userID is “AHGK1133” Than user email:is “abcdapp+ [AHGK1133@gmail.com](mailto:AHGK1133@gmail.com)” The password is randomly generated and stored for the first time. Register and log in to this account. ---
**Author:** ![jared](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/jared/32/138473_2.png) [@jared](https://community.thunkable.com/u/jared)\ **Post date:** [November 21, 2021, 5:36am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/3 "2021-11-21T05:36:26Z")
^^^^ive done this before. No email verification. Can be a workable solution! The email can literally be [anyRandomValue@test.com](mailto:anyRandomValue@test.com) Password: another random string Save both to the local storage to ensure data persistence across app updates. ---
**Author:** ![tony.ycy.program](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tony.ycy.program/32/100153_2.png) [@tony.ycy.program](https://community.thunkable.com/u/tony.ycy.program)\ **Post date:** [November 21, 2021, 5:42am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/4 "2021-11-21T05:42:35Z")
rule `{"rules": {"Users": {"$user": {".read": "$user == auth.uid && auth.uid!=null", ".write": "$user == auth.uid && auth.uid!=null", }, }, } }` ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 5:50am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/5 "2021-11-21T05:50:30Z")
Okay but typically there’s a Sign Up block that requires email verification. How do you bypass that step? And also with the Sign In block, wouldn’t I need to use the green User ID block instead of my custom random User ID value? ---
**Author:** ![tony.ycy.program](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tony.ycy.program/32/100153_2.png) [@tony.ycy.program](https://community.thunkable.com/u/tony.ycy.program)\ **Post date:** [November 21, 2021, 6:00am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/6 "2021-11-21T06:00:17Z")
Do not judge on the login output block, but it is still recommended to use a valid email: `YOURGmail+ID@gmail.com` You don’t need to use the uid it gives. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 6:05am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/7 "2021-11-21T06:05:07Z")
I’m getting an error about the Identity Toolkit API. So I went and enabled that but now it’s asking me to set up credentials for authenticating to that API. Is that required? ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/c/f/cf6e09a1f8802e9d662409b8284448da4fa1782a.png) I don’t remember ever doing that for my other Firebase database which already uses authenticated sign ins (email + password). ---
**Author:** ![tony.ycy.program](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tony.ycy.program/32/100153_2.png) [@tony.ycy.program](https://community.thunkable.com/u/tony.ycy.program)\ **Post date:** [November 21, 2021, 6:07am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/8 "2021-11-21T06:07:03Z")
I can find the api on the project setting page on the firebase console. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 6:29am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/9 "2021-11-21T06:29:17Z")
Do you mean the Web API Key or something else? ---
**Author:** ![jared](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/jared/32/138473_2.png) [@jared](https://community.thunkable.com/u/jared)\ **Post date:** [November 21, 2021, 6:29am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/10 "2021-11-21T06:29:19Z")
Using the uid would generally allow you more security as the uid is only ever returned to the logged in user. > [@tatiang](#): > > getting an error about the Identity Toolkit API. So I went and enabled that but now it’s askin When does this happen? > [@tatiang](#): > > Okay but typically there’s a Sign Up block that requires email verification. How do you bypass that step? Which block _requires_ verification? You should still be able to log a user in without verifying their email. How else can the app tell you if they have verified or not without logging in that person anyways, right? Typically, a developer may just limit what a logged in user can do if they haven’t verified their email yet. In some cases, you may not allow them to pass the login portal at all without verification first. Just depends on your use case. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 6:33am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/11 "2021-11-21T06:33:03Z")
If I use the Sign Up block, I see this error immediately: ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/a/9/a9bdb91ce06f68d688807d1a7b34427678f37b09.png) And with Sign In, I see this: ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/f/1/f181d7a68804f95debeeec3e51dafeec8aa8d622.png) ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 6:43am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/12 "2021-11-21T06:43:57Z")
Thank you. I had the wrong API key entered in the project settings in Thunkable. I’m no longer getting the errors about the Identity Toolkit API. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 7:06am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/13 "2021-11-21T07:06:12Z")
Those rules are not working for me. Before I changed the rules, I was able to get the value from /Users/`app variable user ID` but now I can’t: ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/a/3/a31de23529ad4d74c806eb6c79fd59728d8f6d5d.png) ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [November 21, 2021, 7:25am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/14 "2021-11-21T07:25:21Z")
> [@\[Solved\] All published Apps stop Working! Urgent help please!](https://community.thunkable.com/t/solved-all-published-apps-stop-working-urgent-help-please/1575666/43): > > @ethosworkfi To use the token you need first to sign in to Firebase. The Sign In component does this for you and use the token internally. If you want to do it yourself then you need to setup Web API with the following: Header should have Content-Type set to application/json URL should be https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key= and add your Firebase API Key to it. Use Web API POST block to get the information See this as an example Of course in… This is how you login without using `sing in / up` block of Thunkable and can use your own single email login and then control the access from your app. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 9:38am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/15 "2021-11-21T09:38:42Z")
It does work with these basic rules: ```auto // Only authenticated users can access/write data { “rules”: { “.read”: “auth != null”, “.write”: “auth != null” } } ``` But not with these rules that @tony.ycy.program suggested: ```auto { "rules": { "Users": { "$user": { ".read": "$user == auth.uid && auth.uid!=null", ".write": "$user == auth.uid && auth.uid!=null", }, }, } } ``` ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [November 21, 2021, 9:48am UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/16 "2021-11-21T09:48:56Z")
The _suggested_ rules assumes using the built in user id not a custom made one. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [November 21, 2021, 5:02pm UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/17 "2021-11-21T17:02:27Z")
That’s what I was thinking. Do you think it’s fairly safe to use the “only authenticated users…” rules I posted right above since the user will never know their own random username and password and since there is no way to access any one else’s data from within the app? Not to mention, there’s nothing confidential about the data… it’s really just a list of food items. 🙂 ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [November 21, 2021, 5:48pm UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/18 "2021-11-21T17:48:26Z")
I believe this is a workable solution without compromising the data security. The email and password is something that you will choose yourself and for me I set verification to false and use a dummy email to use it as an `app login`. All other functions I control by the app itself. Again, you can choose to use the API calls to login or use the `Sign In` component and provide the email and password in the code without any GUI components. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/0/f/0f59f292712368bce16ff80133ae10de8a6f27e8.png) [@system](https://community.thunkable.com/u/system)\ **Post date:** [February 19, 2022, 5:48pm UTC](https://community.thunkable.com/t/firebase-rules-for-secure-access-without-sign-in/1626508/19 "2022-02-19T17:48:32Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.