accessing email address in firebase rules [duplicate]

Question

This question already has an answer here:

• How can we guarantee that the email saved by the Firebase user is indeed his own email? 1 answer

I'm using firebase 3. When writing firebase rules, the auth object only contains the uid and the provider. Is there any way that this could be enhanced to also provide the email address?

The problem that I'm trying to solve is that the owner of the site I'm working on wants to permission users based on their email address, because he won't know their firebase uid up front.

I have seen solutions to this suggesting to persist the user object in firebase (with the email) and then use that as a reference point in the rules. The problem I can see with that is that if someone knew the email address of a user with full privileges, it would be fairly easy to debug the code, and manipulate the email address prior to saving into firebase, which means it would save their firebase id alongside someone else's email address.

The only way I can see to make this safe is to have the email address provided in the auth object in the firebase rules, which can't be hacked.

Am I missing something?

---

MORE INFO

---

The idea is that we can control access to data for a specific location by adding the location name to a user's email address:

1. A user is created ahead of time manually by the site manager, providing access to a subset of data. e.g

-users
  -user1Email
    -locations
      -someLocation:true
      -someOtherLocation:true

2. The user authenticates via google. On the client side we can see their email address in auth.user.email

3. In the rules, I want to do something like

locations : {
  "$location": {
      ".read": "root.hasChild('users/' + auth.email + '/locations/' + $location)",
   }
}

I know I need to escape the email address, just trying to keep it simple for now.

I've tested this out in the simulator and it works perfectly if I use a custom provider and provide the email in there, but using google the "auth" in the rule only has uid and provider properties, not email.

The alternative (other than using a custom provider) is to allow the user to create their account first, and then the locations are added to each user using their uid as the key rather than their email address, but the owner wants to be able to set it up ahead of time so that the first time they log in it words straight away.

Answer 1

Firebase team is still working to provide the email in the auth object and you can find it with some limitations using auth.token.email in your rules. Please take a look in this post to get more details.

If the current firebase solution doesn't handle all your needs there is some options to workaround.

Since you want to keep your current /users structure you could, whenever registering a new user, link the user uid to the corresponding email in a new branch /user_emails that will simply store $uid: email. Then your rules will look like the following.

 "user_emails": { 
    "$uid": {
       ".write": "auth.uid == $uid",
       ".validate": "!root.child('Users').hasChild(newData.val())"
    }
  },
  "locations": {
    "$location": {      
      ".read":  "root.hasChild('users/' + root.child('user_emails').child(auth.uid).val() + '/locations/' + $location)"
    }
  }

Keep in mind that you will need to enhance them to ensure that only the right users will be able to edit this new user_emails branch.