title: Firebase Security Rules Block Writing to Firebase
body: <p><em>Note: This question is tagged</em> <code>polymer</code> <em>because the Polymer library is used to generate the Javascript.</em></p>
  
  <p>This question is about two different but related problems dealing with Firebase security. Problem 1 and Problem 2 seem to suggest opposite realities and opposite results when trying to get the Firebase security rules to work. (FWIW: <a href="https://stackoverflow.com/q/34301172/1640892">Here is my prior unsuccessful attempt to write this question</a>.)</p>
  
  <p><a href="http://jsbin.com/hinehoyigo/edit?html,output" rel="nofollow noreferrer">Here is the live code in a JSBin</a>.</p>
  
  <p><a href="http://jsbin.com/hinehoyigo/edit?html,output" rel="nofollow noreferrer">http://jsbin.com/hinehoyigo/edit?html,output</a></p>
  
  <h1>Problem 1</h1>
  
  <h2>Firebase Security Rules Block Writing to Firebase</h2>
  
  <h3>Instructions</h3>
  
  <ol>
      <li>Enter your firebase ID. Example: "hot-sauce-123"</li>
      <li>In a new tab or window, go to your firebase and open it</li>
      <li>Allow anonymous auth: 
          Your firebase 
          > Login &amp; Auth 
          > Anonymous tab 
          > Check "Enable Anonymous User Authentication"</li>
      <li>Apply no security rules: Security &amp; Rules > 
  
      <pre>{
        "rules": {
          ".read": true,
          ".write": true
        }
      }</pre>
      </li>
      <li>Return back to jsbin</li>
      <li>Select "anonymous" as auth provider: dropdown menu > anonymous</li>
      <li>Click button labeled "login"</li>
      <li>Verify login status per fields to right</li>
      <li>Open your console: Chrome > View > Developer > Developer Tools</li>
      <li>Click button labeled "Print User to console"</li>
      <li>Double-check login status by verifying user object printed to console</li>
      <li>Click button labeled "Print Firebase to console"</li>
      <li>Verify correct firebase by checking Firebase URL printed to console</li>
      <li>Click button labeled "Write to Firebase — Plain Url"</li>
      <li>Check your firebase data; notice no write occured</li>
      <li>Click button labeled "Write to Firebase — .json Url"</li>
      <li>Check your firebase data; notice successful write</li>
      <li>Distinguish the two write attempts because former attempts to write {"quux":"baz"};
              latter attempts to write {"jquux":"jbaz"}</li>
      <li>Add security rules: Security &amp; Rules > 
          <pre>{
              "rules": {
                  "users": {
                      "$uid": {
                          ".read": "auth != null && auth.uid === $uid",
                          ".write": "auth != null && auth.uid === $uid"
                      }
                  }
              }
          }</pre>
      </li>
      <li>Click again the button labeled "Write to Firebase — .json Url"</li>
      <li>Check your firebase data; notice write <strong>NOW FAILS</strong></li>
      <li>Conclusion / Problem Statement: Firebase security rules block writing to Firebase.</li>
  </ol>
  
  <h1>Problem 2</h1>
  
  <h2>Simulator blocks .json URL from being used (as required above)</h2>
  
  <h3>Instructions</h3>
  
  <ol>
      <li>Open your Firebase</li>
      <li>Verify security rules are in place (see above step #19 in Problem #1)...</li>
      <li>Open your simulator: Vertical Navigation Menu > Simulator</li>
      <li>Check radio button labeled "Custom Auth"</li>
      <li>Custom Auth input field should read something like
          "{ provider: 'anonymous', uid: 'ag69g401-f097-4171-bca4-927fd1a6e1f3' }"</li>
      <li>Click button labeled "Authenticate"</li>
      <li>Verify little green check mark is next to radio button labeled "Custom Auth"</li>
      <li>Go to section 2</li>
      <li>Click tab labeled "Write"</li>
      <li>In input field labeled URL, enter "users/ag69g401-f097-4171-bca4-927fd1a6e1f3/foo/bar"</li>
      <li>Verify the user ID in the URL path you just entered, matches the uid value in the above Custom Auth field</li>
      <li>Click button labeled "Simulate Write"</li>
      <li>
          Notice response says something like:<br>
          Attempt to write <code>{"key":"value"} to /users/ag69g401-f097-4171-bca4-927fd1a6e1f3/foo/bar</code> with <code>auth={"provider":"anonymous","uid":"ag69g401-f097-4171-bca4-927fd1a6e1f3"}</code><br>
          <pre>/
  /users
  /users/ag69g401-f097-4171-bca4-927fd1a6e1f3:.write: "auth != null && auth.uid === $uid"
      => true</pre>
              Write was allowed.
      </li>
      <li>Notice: This result is the opposite result from above steps #14 and #15 where the plain URL (without .json appended) failed to write</li>
      <li>
          Append ".json" to the URL so the input field reads something like
          "users/ag69g401-f097-4171-bca4-927fd1a6e1f3/foo/bar.json"
      </li>
      <li>Click button labeled "Simulate Write"</li>
      <li>
          Notice response says something like:<br>
          Invalid path.  Simulation aborted.
      </li>
      <li>Notice: This result is the opposite result from above steps #16 and #17 where the .json appended URL was the only one that worked;</li>
      <li>Notice these simulator tests suggest the opposite results than those tested from the live code in above Problem #1</li>
  </ol>