I wanted to know where a auth.token variable is located on a normal js fetch request.
For example, I have these rules:
{
"rules": {
".read": "auth.token=='tokenhere'",
".write": "auth.token=='tokenhere'",
}
}Like a simple password system,
now I wanted to know where that auth.token would go in a fetch request in order to succeed these rules.
Thanks!
You can't pass along custom information to the security rules. The only things available in your rules are:
auth variable, if there is an authenticated user.So if you want to test anything in your security rules, it'll have to be in one of these fields.
For example, if I want to store data that can only be accessed if the user knows some specific secret (like a password), I typically encoded that secret into the path to that data.
{
"rules": {
"correcthorsebatterystaple": {
".read": true,
".write": true,
}
}
}
With the above rules the user can only read/write the data if they somehow know the secret "correcthorsebatterystaple" value.