Controlling Data Access Using Firebase Auth Custom Claims (Firecasts)

The Firebase Admin SDK supports defining custom attributes on user accounts. This provides the ability to implement various access control strategies, including role-based access control, in Firebase apps. These custom attributes can give users different levels of access (roles), which are enforced in an application's security rules. In this episode of Firecasts, Jen Person gives us an overview of custom auth claims, how they are useful, and what you can do with them! If you want to create a custom user experience for different kinds of users, then follow along in this episode of Firecasts!
Links:
Guide - Getting Started with the Admin SDK → bit.ly/2QMrIji
Guide - Overview of Firebase Auth Admin → bit.ly/2O4dT14
Guide - Firebase Admin Auth Custom Claims → bit.ly/2OBb9Fr
Firebase Auth Admin SDK Codelab → bit.ly/2Dkfvjr
Guide - Understand Realtime Database Rules → bit.ly/2MRUIUA
Guide - Secure Data in Cloud Firestore → bit.ly/2Qqrpuj
Guide - Understand Security Rules for Cloud Storage → bit.ly/2MSa22w
Firecasts Playlist → goo.gl/Ud2b5L
To keep up with the latest from Firebase, Subscribe! → goo.gl/9giPHG

[@phidias51]

It would be easier to manage user roles using claims if the firebase console had a page that allowed the admin to set claims for individual users. Role-based security is one of the most common tasks that administrators have to deal with and having to write code to support it doesn't make for a great user experience.

[@rayhanulislam1675]

Very good point Sir

[@nikeshmadhav4156]

Hi, I have a query. I would like to create a model in which, A school will have multiple teachers and those teachers will have multiple students and students will have multiple courses details. What will be the optimized model for this scenario for cost efficient firebase CRUD. Thanks in advance, really need solution for that.

[@bustamantedev]

Is there a particular reason why managing custom claims is not a feature available in the Firebase Console? It just feels odd having to use the Admin SDK just to be able to do so

[@MrAlex9939]

I agree!

[@radulaski]

It would really make sense to add something like that.

[@pedroramirez5905]

I agree

[@anujraghuvanshi07]

Agree!

[@ThatGuyAnonymous]

Totally agree! It makes perfect sense to view/set claims from the console.

[@B33SON1]

I think firebase security is by far the most difficult part about using firebase and Firestore. It’s too bad considering everything else about firebase is such a pleasure to use.

[@jenmansfield3207]

B33SON that’s very valuable feedback! I agree that it is a very complicated area and utilizes a format that is unlike other things I work with. I sort of felt like I had to learn another language. Do you have any suggestions on how rules could be improved!

[@andrews8725]

Jen Person I love that you can write functions in security rules but I feel like it could also be beneficial to have variables. For instance there could be a use case where one function returns something I may want to store in a variable to do something with then pass to another function. I tried months ago just passing a function as a param to another function but wasn't able to get it to work. Also with variables maybe i just want to define some constants or an array that is used in multiple functions. Just throwing it out there. Thanks.

[@Shabasky1]

To be honest a UI would be cool. Like instead of a language a feat similar to MySQL workbench when it came to giving users privileges... But at the same time node express like to where you could capture the token and move with it conditionally. This helps though. More videos work too!

[@dr.z7958]

@@jenmansfield3207 Yeah, you can make a graph editor for the rules, which connect already made templates togethers. For example you choose a path then connect its read to an auth user, or connect it to variables in between.

[@1002CK]

Is it possible to add console control to Firebase security for easier control, and developer can check exactly which collection of user has access authority to any data on console #AskFirebase

[@MarkValenzia]

Thanks Jen, you've just confirmed I'm doing this correctly in my app (customer claims applied by a cloud function)! Also great to know the reads from Firestore rules are including in the quotas. I wish I'd had this video 2 months ago, would've made my life a little easier when implementing. Great content and a great product, thanks!

[@abnerescocio]

Hello guy. How to apply custom claims to any firestore request (read or write) from androi application with cloud functions?

[@AmanVishnani]

Something I was looking for over an year now! Good Job!

[@jenmansfield3207]

Aman Vishnani that’s so great to hear! Be sure to show me what you build!

[@anshsachdeva2013]

I was developing an app requiring the exact feature in 2017. Was searching internet like a mad man, i couldn't find a thing. At the end i thought it must be something to do with the server side rules, but i couldn't just figure it out That app went to stub that time due to various other reasons, but i guess i will visit it again :) Thankyou for such an awesome explaination!!

[@MrAlexdunlop]

This is very awesome! Can't wait to use Custom Claims another reason why I love Firebase!

[@CSClass]

This video is 2 years old but this helps me a lot .... Thank you....

[@dilass]

It's nice to see that this feature is getting more attention

[@jenmansfield3207]

Dilan Omer totally! I’m the biggest cheerleader for Auth claims. Seriously I think people around the office are getting sick of hearing about them 😂

[@dilass]

Jen Person it is a really useful feature, even if you just have say, admin and public users. It's a simple way to create that gap between different types of users. I first heard of it from Chris Esplin, and it was then I realised this seriously needs more attention

[@vaishnavambre3683]

@@jenmansfield3207 Is there a way to create an admin panel in Firebase for a React Native app? If there is, how would I go about creating it?

[@WhatIsThisAllAbout]

Each and every word Jen(pardon if i got her name wrong) said is useful for understanding custom claims.

[@_sr]

Ok... First, thanks a lot for the video. Custom claims will surely prove to be useful in many cases. But I have some question to get some clarifications on the concept: 1- If a user has logged in and you add/remove a custom claim they won't have it on their claim until the next time the token is issued. 2- Each client SDK has a method to "refresh" the firebase token, this can be used wherever appropriate. Questions for 1 & 2: Does refreshing a token(2) has the same effect as re-issuing the token(1)? Looking at your annotation sequence I get the impression that it has the same effect. 3- Firestore, real-time database and cloud storage update permissions based on changes to users' uid, not the refresh token. Even if you refresh the token, security rules will not reflect changes in access. User needs to sign out and sign in again so that firebase products look at the permissions of the latest token. Question for 3: Are the custom claims cached somewhere on these products and these claims are only fetched whenever a user logouts and logs back in? In this case, the only proper way to securely reflect the changes in the claims is to kick the user out, correct? By updating "permissions" you mean "custom claims" right? When I refresh a token, I get the new claims on the client but I can't reflect the changes on the server side for firebase, firestore, storage. This implies custom claim records are not read from the place they are stored by these products, instead they are cached somewhere and this cache needs to be updated by a sign-out, right? This part is a little foggy as far as this video is concerned. Cheers

[@msjahun]

Thanks for this video, I've been doing things wrong this whole time

[@Jonathan0wh]

I think firebase authentication itself could be more... customizable and user-friendly, allowing developers to add custom user profile properties and set different user groups more easily, without setting up an additional collection for users in Firestore or asking for help from Admin SDK.

[@junight]

Really useful and well expained

[@lgopt7467]

We have other solutions for stuff like this.. But this just saved us of writing & planning tons of code! Thanks!!

[@jenmansfield3207]

Lg Opt glad you like it! And you’re right there are definitely other ways to solve this problem. This one just works so elegantly for certain scenarios

[@softwarebureau666]

Love this video 🔥

[@tomascarignano5002]

This firecast was so frickin useful!

[@Firebase]

Happy to hear the tutorial was helpful, Tomas. Be sure to subscribe to keep up with the latest from Firebase: goo.gl/9giPHG

[@cpc4466]

Thank you , great information and video

[@Firebase]

Our pleasure!

[@Themusicaligera]

Great video!!! Awesome Firebase!!!!!!

[@ibrahimtilki9870]

The video i have been expecting ❤️

[@jenmansfield3207]

ibrahim Tilki Same! I’ve wanted to make this for a long time. Hope it helps!

[@ibrahimtilki9870]

@@jenmansfield3207 It helped a lot. I was about to implement user roles using only security rules. Thanks for awesome support!

[@EduardoOviedoBlanco]

This is súper useful, thanks.

[@jenmansfield3207]

Eduardo Oviedo Blanco glad to hear it! If you build something with Firebase and use Auth claims, I’d love to hear about it!

[@acche-rc]

wonderful, just what I need

[@jenmansfield3207]

acche2 so glad to hear that! I can’t wait to see what you build :)

[@Saturn2888]

It'd be nice if I could view and edit claims from Firebase Console. Having a Cloud Function is great, but when developing, it's much easier to test using the Firebase Console then configure in a function once I have a good understanding of how I might use claims, how I'd define roles, etc.

[@softwareengineer9435]

Thanks there.

[@rockdoginteractive]

The code provided requires one to already have a Custom Claim role to add a Custom Claim role... nice.

[@_terrapirata]

indeed.. I guess they didn't want to make it easy

[@ZGfang]

It's amazing!

[@trophydevelopers]

great thank you

[@Firebase]

We’re happy to hear you enjoyed the video! Be sure to check out the links in the description for more great videos and content 😎

[@digimbyte]

so you can set and update a custom claim, but how do you remove/delete it? you never discussed revoking permissions!

[@fluttermakers]

I love your voice, very good tutorial thanks

[@aymerichenouille75]

Merci Pam Beesly !

[@wuji5771]

Is there an updated version of this guide anywhere? I'm assuming a lot has changed in 4+ years.

[@subhashsalian3387]

Will this be a good option to check if the user is accessing the database from App and not accessing it directly, so that I can write security rules to allow access only from the App?

[@WhatIsThisAllAbout]

"Relying solely on client-side use of custom claims is not secure" Noted.

[@essamahmed4774]

Great video, thanks a lot. Can we use this feature to allow a user to have 2 separate accounts with different roles using her/his same Email & mobile phone number in the 2 accounts while differentiate them using another attribute like user type: e.g. Seller or Buyer?

[@bhaveshgurav4124]

Failed to resolve: firebase-auth-15.0.0 Open File

[@yoapps137]

How could I structure my Rules in a given situation: I have registered users under a USER ref that has "Display_name, email, age, has_Paid". He has read & write permissions to his User node. BUT has_paid should only be allowed to be edited by my Firebase CloudFunctions Script. He should not be able to write or edit "has_paid".... how to do this?

[@idali24]

see FireBase codelab / Security Rules : "The answer is to compare the values in the resource.data object (which contains the values that currently exist in the database) and the request.resource.data object (which contains the "hydrated" values of the object to be written, and make sure these values aren't changed". match /users/{userID} { allow update: if request.auth.uid == userID && request.resource.data.has_paid == resource.data.has_paid; … }

[@robertshawnmitchell]

This is very good stuff. I use React Loadable to conditionally load restricted app logic. It would be so great if there was a way in firebase hosting to apply security rules to individual named chunks of app code.

[@jenmansfield3207]

Shawn Mitchell that’s a neat concept! It would be super useful for sure. Right now I implement that myself in Vue using conditional parts of class names that are then associated with different CSS blocking or showing the div, but I’ll be the first to admit this is clunky. I’ll think about better ways to implement that and who knows? Maybe it’ll be a future Firecast.

[@vaishnavambre3683]

Is there a way to create an admin panel in Firebase for a React Native app? If there is, how would I go about creating it?

[@ThatGuyAnonymous]

Amazing video! , but I don't understand why it's still not possible to view and update custom claims from the firebase admin panel, it'll totally make sense #AskFirebase

[@manastiwari1223]

Why are there no Firebase Docs in Typescript ? How do I refer my Typescript codes? :(

[@lesmo34]

Remember Typescript is just JavaScript with some sugar on top. It'll work as is.

[@harpymaslow]

Damn that's really cool. Too bad I just hear about it now :'D

[@mslong13]

Could you explain in more detail what makes it a "bad experience" for end users if developers add a bunch of claims to their auth token? Would the example you showed with address and a few other details really impact the delivery speed in any noticeable way?

[@jenmansfield3207]

Maxime Long sure! That token is passed along with many different requests. It’s purpose is to identify the user. Each claim takes up space, so that’s more data used each time a request is made.

[@ijazahmad7525]

Hy.. i have a problem in my firebase databaae.. when wifi disconnect firbaae also diaconnect and not connect even after wifi on. Can u help me?

[@JSANL]

Wait, i'm not sure if I understood the last point correctly, but if e.g. Firestore permission are updated only when the user logs in and out again, couldn't this be used maliciously? For example, if a moderator at the example page now edits movies with wrong intentions and get's his role revoked(so he get's the claim removed), then it's on the client side to log him out, so that the permissions actually change?? Isn't this very insecure, as e.g. the moderator could just delete the code to be logged out and still have all the write access?

[@jenmansfield3207]

JSAN L. I filed a bug about this and it sounds like since I’ve recorded this video, the way Cloud Firestore responds to rules is different. Now a token refresh is sufficient to update rules. This means the user may have access for up to an hour, which is how long it takes for a token to refresh.

[@jenmansfield3207]

So yes there is still a time period where they may have access. You can build points into your code where you force token refresh if it’s essential for the functioning of your app.

[@JSANL]

Jen Person Thank you very much for your answer!

[@jamesmcintyre]

Jen Person So, just to clarify- If server-side a claim is modified then my server tells the client to perform a 'firebase.auth().currentUser.getIdToken()' this should immediately pull-down the newly set custom claims correct? If I can't use this method to have custom claims immediately reflected then I won't be able to use claims is why I'm asking. Btw your videos are awesome! Thanks for doing such an awesome job!

[@ingjoelarielsosa4779]

Greetings, please could you be so amble to make a video. Where certain roles are allowed to do a number of writes per month

[@raghav4296]

#AskFirebase Hi Jen, w.r.t custom claims, the security rule at the server side relies on claim value that is sent by the client as opposed to the model of the server verifying the claim made by the client for every request. And as a counter measure, we do the token refresh at the client side when the claim value changes or wait for an hour. This looks ok on an assumption that the token available with the client SDKs cannot be compromised. But does this model guarantee security.? Thanks for your time!

[@juanguang2076]

where/ what files do we put those rules in?

[@JJJTTTBBBCCC]

The complexity of the security roles is the biggest disadvantage of firebase, but it is learnable. Other hand it would be nice if we can be able to control the response fields. In case of if i'm a moderator, than i want to see the costumer's billing data, but I don't want to make it visible for the non moderator users. It is not so a security role, its more than an response modifier.

[@stevengao8345]

I have a simple case, that in my firebase database I have 100 messages come from 5 different users, only the user who wrote the message will be able to delete it, and other 4 only can read it. I use firebase, can you give me some hint how to do it ? I read document many times only some basic stuff. auth != nil which is not enough, and firebase keeps warning me. please help , thanks.

[@JoshuaScott388]

How would you go about groups? User is admin of one group and a member of another. So you could have 100+ groups. User might be part of 20 of them.

[@corysmc]

I had this same question. I don't think my users would be part of 100 groups.. but they could be part of more than one which should fit within the limit of custom claims, but I want to be sure it does scale if they are part of more groups. In that case would you just need to run those checks within security rules?

[@jasontissera5739]

Hey folks, I was having trouble finding the links that Jen mentioned in this video, they weren't included in the Description. For anyone else that's looking for them, here's a Medium post that Jen provided with the exact links. medium.com/google-developers/controlling-data-access-using-firebase-auth-custom-claims-88b3c2c9352a

[@NezNez]

How does the very first moderator aquire the `moderator` role?? how to "seed" user in the auth that have pre-installed `moderator` custom claim?

[@PakSoerja]

sorry for this stupid question, but how do you call that grantModeratorRole from the client (in my case I am using flutter) when it is not a callable function? should I write another callable function? I am a total noob on cloud functions..

[@DA-gs2rl]

Hi Jen, great video! What is implied by a secure environment? If I intend to host the code on Firebase hosting, is that secure? Thanks.

[@lukecross5439]

whatever

[@samuelmarndi]

The fireflicks repository is not working and there are no other codelab or reference to use custom claims 😕 (while npm installation it gives errors)

[@MoviesReviews-dc5hs]

Codelab is missing and I don't know why they didn't show how to setup the Admin SDK as part of this....

[@wahabrehman6848]

how do i call the grand operator function in react

[@JFkingW]

Maybe I didn't understood something but when we only allow admins to promote users to admins, how do I get the first user to become an admin? As far as I know there is no way to give custom claims to a user from the console...

[@DeanStamler]

I haven't yet tried it but the solution would appear to be here: github.com/googlearchive/fireflicks/blob/master/backend/admin-service/src/promote.ts

In the past, I have used firebase.auth in the web client and once a user creates another user, I link certain security logic: Once the user has been created I send an email to verify your email with the function user.sendEmailVerification (). As the user was created by another user, I assign a default password and use the sendPasswordResetEmail () function so that the user registers his new password. That has worked well for me so far, but now for many reasons I need to move that logic to my server, for that I'm developing a backend with cloud functions and I'm using the Node.js Firebase Admin SDK version 6.4.0, but I can not find a way to use the functions of user.sendEmailVerification() and sendPasswordResetEmail() to implement the same logic on the server, the closest thing I found was: auth.generateEmailVerificationLink (email) auth.generatePasswordResetLink (email) But it only generates a link for each one, which by the way the only emailVerification() serves me, the one from generatePasswordReset always tells me: Try resetting your password again Your request to reset your password has expired or the link has already been used. Even though be a new link, and it has not been used. My 3 questions would be: How can I make the sendEmailVerification () and sendPasswordResetEmail () functions work on the server? How can I make the link generated with auth.generatePasswordResetLink (email) work correctly on the server? Is there any way to use templates and emails on the server that are in firebase auth? #AskFirebase Thank you in advance for sharing your experience with me, with all the programmers' community of firebase.

[@ramyniranjan5751]

The Codelab link is broken, anybody knows where I can find it?

[@whatsthestoryborrey5665]

I was wondering it would be advised to change custom claims based on some context (i.e. they are on a certain document or collection )? This would be for cases where one could be a moderator for certain chat rooms but not all chat rooms ( it gets more tricky if moderator is not a statically defined ) What I was thinking would map to something like this: - When a person enters a room (room 101) then it will automatically update all it's claims on "room actions" it can perform i.e. { canBootUserFromRoom101 : true, canReadMessagesForRoom101 : true } - If the person leaves the room and enters another room then it will update claims again so that it can do things like i.e. { canBootUserFromRoom102 : false, canWriteMessagesToRoom102 : true } etc. The biggest reason for this is if there is something shared link between FireStore and Storage ( like room images / videos ) the rule under Storage can not access things in FireStore.

[@jenmansfield3207]

That's an interesting use case! I'd say it depends on how many claims you think a single user will end up having. Remember the 1000 byte limit, so each user can only hold a small amount of info about their permissions. If each user will be a member of multiple rooms and have different permissions for each one, it will be hard to store all of that in the limited space of claims. But you have a really good point about the fact that claims would be especially useful for Storage rules since you can't look up database info from there. I think I'll play around with it a bit and see how many claims I can get for 1000 bytes. I'll let you know what I find!

[@JoshuaScott388]

I was asking the same concept. Perhaps a roles. Groups. Permissions. Auth0 has some concept of this but I don’t want to use Auth0. auth0.com/docs/extensions/authorization-extension/v2 is more detail. Maybe take that concept and apply to firebase auth.

[@corysmc]

I'm also interested in this use case. I might be able to get away with storing it in claims depending on how many I can fit in there. My thought was storing the claims like this: { [group_id: string]: 'owner' | 'editor' | 'viewer' };

[@imesamuel6731]

Nice explanation, unfortunately this doesn't solve the problem of allowing a non-technical admin(with no knowledge of firebase rules) set and update rules for different users. This will make more sense if there is a way to update the rules with a friendly UI for a non-technical admin.

[@masterlup]

07:03 am I understanding correctly that the test/ decision if im allowed to add a moderator is again IN THE FRONTEND ? Everything that is decided in the frontend can be hacked ????

[@Frank_van_Puffelen]

This is actually backend code, that runs in Cloud Functions. The first `if` in there checks if the user making the call is a moderators themselves. So only moderators can appoint other moderators. So while the front-end makes a call to this code, it is a completely secure approach to appointing moderators.

[@burtonator]

Suggestion.. use a type of Email not a string... just helps with readability. export type Email = string;

[@lazymacs2823]

Is there any alternative for custom claims?

[@JFkingW]

Thats great and seems quite simple! I will defenitly check that out. However one question: Is it possible for someone to "fake" an auth token? This way someone could fake being an admin and promote his real account to an admin...

[@pkop4]

JWT's can't be forged without the private key. You have no way of producing a valid signature stackoverflow.com/questions/27301557/if-you-can-decode-jwt-how-are-they-secure

[@jenmansfield3207]

J fking W great question! It wouldn’t be possible to fake an Auth token’s claims because of how they’re encoded.

[@anudeepananth]

Can we changes id tokens dynamically for like social network where access to user database changes based on the users friendship status.....

[@jenmansfield3207]

Anudeep Ananth good question! I’d say this wouldn’t be the best use case for Auth claims because you’d need a separate one for each user they’re friends with. Mapping in the database is probably a better option.

[@anudeepananth]

@@jenmansfield3207 Alrite... Thanks :)

[@atealab6152]

Noobish question here: since firebase is considered 'server-less'. meaning that it could practically work without developing a separate back-end server as Firebase could directly work within the mobile app code for example. Is it viable to set custom claims within the code of the mobile app as it is considered server-less ?

[@atealab6152]

@@ToddKerpelmanCorp thanks for answering. If I want an easier way of controlling claims, unfortunately the main firebase UI doesn’t provide that, do I have to develop my own server just for that or Is it possible to use firebase Functions?

[@deanjackson3238]

How about setting up the first admin in the custom claim? I mean If i need to be admin to setup first admin how can i setup the first one? (I mean I could disable the app and do it first without the onCall security check but is there another solutions ?) Also please when making this kind of course, why always showing firestore code? I mean there also RTDB user, please add both codes.

[@Firebase]

Hello! When starting the app for the first time, create an admin account with a default password. Force the admin user to change the password when they first sign in. During this process, you can then add the "admin" custom claim to their account. The "Security Rules" for RTDB are shown at the 8:32 time stamp. We hope this helps you on your journey!

[@grafterallday3763]

How do you do 5:47 - 5:51 ???????????????

[@jpay]

Wait, am I supposed to Use Firebase Security Rules? 10:55 Will do! :P

[@nikeshmadhav4156]

Hi, I have a query. I would like to create a model in which, A school will have multiple teachers and those teachers will have multiple students and students will have multiple courses details. What will be the optimized model for this scenario for cost efficient firebase CRUD. Thanks in advance, really need solution for that.

[@bhaveshgurav4124]

how to solve this type ofauth problam ( implementation 'com.google.firebase:firebase-auth:16.0.1:15.0.0' )

[@thianesh9097]

Can custom claim be other that boolean ? for Example: allow read, write: if(request.auth.token.level < 11); anybody...

[@rickvian]

AUUUUGGHHHHH! USE FIREBASE SECURITY RULES!

[@mijkal]

❤️ RBG! 😎

[@jenmansfield3207]

Michael Gifford isn’t it such a good sticker? ☺️

[@rendomone]

@AskFirebase Logical OR in queries and GEO queries when?

[@1002CK]

Is it possible to add console control to Firebase security for easier control, and developer can check exactly which collection of user has access authority to any data on console #AskFirebase

[@MultiJd4]

As always firebase, this is a great video. I have a requirement where i would like a user role/firebase custom claim to be set at the time of registration, this will depend on the client app the user is registered on, e.g in the teachers app i would like all the registered users though this app to have the teacher role/claim and likewise in the students app all users to have the student role/claim. what would be the best approach to do this?

[@vatsalbhuva1471]

hey, been quite a while since you asked this but i'm stuck on a similar problem and wanted to know if you got any answers. i'm registering a user using client sdk, but when i pass their uid to the server to create custom claims using the admin sdk, i get the error saying "Error setting custom claims: FirebaseAuthError: There is no user record corresponding to the provided identifier." Any help would be greatly appreciated!

[@vatsalbhuva1471]

@@ahmedjaad4940 okay, thanks alot! didnt expect a reply so soon :)

[@MultiJd4]

@@vatsalbhuva1471 hey I don''t even remember asking this question 😀, I haven't touched any firebase stuff in 3 years now. I still have access to the codebase of the project in question, I will take a look sometime later and see how I got around this issue

[@Neoracu]

RBG Rocks!!

[@jenmansfield3207]

Edgard Ochoa yaaaas love my dissent RBG sticker 😁

[@thalibmuhammad9519]

thanks, AAUUUUGGGHHH!!!!!!!!

[@pushandhabalia1501]

Can I set object to key like {"moderator": {rank: 3}}

[@victormungai]

Is there one for android?

[@TechnoAllArab]

first thank you for this video , how can implement that with dart

[@edberaga]

Is this project is outdated? Will it work at firebase v9?

[@Frank_van_Puffelen]

The only thing that fundamentally changed in v9 is the syntax. Aside from that, all functionality remained the same. The documentation shows the v8 and v9 syntax side-by-side, which should make it easy to upgrade. If you struggle with a specific code snippet, posting it to Stack Overflow (with what you already tried) is probably a good place to get help.

[@katherineprado3193]

pueden realizar un ejemplo con unity

[@lit22006]

@5:41 since JS on client side, isn't that risky! anyone could manipulate the DOM and send whatever custom claims they want!!

[@shinobi77]

Why not using the same parameter names for all the architectures? Why should I memories the name on swift & android & web!!!!!

[@VolcanicPenguin]

If I'm gonna have to write code for this why am I not just writing my own Node Express backend.

[@markusgattol]

I like firebase a lot. It has majored a lot over the last two years, most things are well documented, and you get an overall coherent experience as a developer. However, what's still way to time consuming and to tricky to scale are security rules. This area is lacking behind all other areas in terms of usability and the ability to scale a codebase. Maybe some kind of metalanguage is needed so to create an abstraction that can bring more speed and better scalability...

[@jenmansfield3207]

I totally agree with you! From what I understand, the plan used to be that the format of rules for Cloud Firestore and Storage would be adopted by lots of products and therefore be more familiar to developers. That adoption hasn't happened, leaving Firebase products with a security language that's rather esoteric. We have team members dedicated to improving rules, and we have added some useful features over time like the ability to include functions. That being said, there's a long way to go. Thanks for bringing this up and keeping us honest :)

[@siddharthsvnit]

I am not able to get started with firebase storage, it is failing to create initial default bucket it is saying some unknown error, and refresh it and try again.

[@akauppi2]

Did you intend the comment to this video? I fail to see the connection.

[@Suriprofz]

This all seems so hackish tho... Why not just return a token which I can save in the localstorage and verify by firebase on every route... Could be so easy and serverless.

[@Transactional]

👍🏻

[@sagarshende309]

I have an Admin authentication problem Any One From Firebase Team has Solution i want to make App for Admin And Client how to do this thing in flutter Anyone Know How to Do this things...

[@beeaura]

FIREBASE!!!!!

[@geelemo]

who was able to actually implement this

[@edberaga]

This is so hard to understand...

[@ismailmoussi6281]

Kotlin??

[@rachidxx94]

Hi i would like to ask if it is possible to add custom Claims like that: { roles:["ROLE_A","ROLE_B"] } And at the same time write correct realtime databse security rules like : ".read": "auth.token.roles.contains('ROLE_A') Thanks if someone will answer

[@ttbooster]

Has this changed? It used to work 3 years ago but now it doesn't ?? I have assigned an admin but request.auth.token.admin == true gives me Insufficient permission error