‫Instructor: Hi. Within this lecture,
‫we are going to begin working
‫on our Firestore security rules so
‫that we can make our app secure
‫so that hackers won't be able to read
‫or write data in a way that they want using rest calls.
‫So that's exactly what we are trying to do over here.
‫And remember, this actually defines the rules
‫of our fire based database usage.
‫So I'm going to delete every comment from here.
‫Okay. These are all comments lines
‫so you can just delete them.
‫As you can see, it starts with match
‫and it follows with allowing reading or writing.
‫Okay? And over here what we see is
‫the allowing reading in writing with a condition
‫so the condition can be deleted like this.
‫So over here we allow reading and writing
‫and if I do that, it will only allow reading, for example
‫and I can just say something like, "Allow write" like this.
‫So this will allow reading and writing
‫in any condition to anyone.
‫So this is good, right?
‫But it's not even close to our purpose of securing this app.
‫So most of the time, developers actually tend to use it
‫in a way like this so that they won't come across
‫with any problems when they test or develop the app.
‫But then later on they forget to change this
‫or they're lazy enough to just leave it like this
‫and it's not even secure.
‫What we can do, we can actually propose a new thing
‫like allowing writing for a condition,
‫for example, or allowing reading for a condition.
‫Okay? And maybe we can say something like that,
‫"Allow write"? If and only if the user is authenticated.
‫So by authenticated, I mean they're either signed up
‫or signed in, so they're logged in.
‫Okay? So in order to do that,
‫I'm just going to write a column over here.
‫I'm going to say if request.auth,
‫So this means that if the request is coming
‫from some sources, okay some source,
‫and if the authentication of that request
‫is not null, for example.
‫So I'm allowing the writing, okay?
‫If request.auth is not null.
‫So like this is not null. So what this is going to do
‫Is to allow reading for any kind of circumstance, okay?
‫So if you're trying to build an app
‫and you don't care if everybody sees everybody's data
‫then this is very ideal for you.
‫For example, in our app, everyone can see the tweets
‫of each other, but if they want to write it
‫if they want to edit it for example
‫or change a tweet or delete a tweet,
‫they should be logged in.
‫So over here you can see it's saved already
‫and we can actually try this right now.
‫So sometimes it can take like a minute
‫or two to make this in session.
‫Okay? So make this available.
‫So if you try this and it fails,
‫make sure you wait for like five minutes
‫and try one more time.
‫But right now I'm just going to try and delete a tweet
‫from here like this. So I'm going to paste it, okay?
‫Come over here and say paste.
‫And I'm going to see if we can actually delete it or not.
‫So we shouldn't be able to delete it
‫because we've changed the secret rules.
‫Here we go. You see the document over here?
‫Now if I run this, okay, I'm a hacker.
‫I'm not related with development side of this thing.
‫I'm just trying to hack into this.
‫And as you can see, I get the status of permission denied.
‫So if I'm not logged in right now
‫then I won't be able to delete this.
‫So this is a good idea to check the authentication
‫because if you make it so then no one
‫can actually reach it through durest calls
‫and they will be only be able to actually
‫do this with an app when they are logged in.
‫So we cant do this for read as well.
‫But maybe we don't wanna do this for read
‫maybe we just want to do this for write.
‫So you can try and find your optimal way
‫of using this and you can try to secure your app
‫following these instructions on the Firestore documentation
‫in order to create a perfectly safe fire based app for you.
‫And of course, we are not going to stop you
‫we're just going to deep dive a little bit
‫and learn about these rules a little bit
‫more in depth so that you can create your own rules
‫in a proper way.
‫We're gonna do that within the next lecture.