title: Best practices for Security about Realtime Database with Firebase?
body: <p>I developed a solution about Push Notifications with Firebase. I am using Realtime Database, FCM, Cloud Functions and Java. The solution is working OK but I have doubt about security. The rules on the Realtime Database are:</p>
  
  <pre><code>{
     "rules": {
      ".read": true,
      ".write": true
    }
  }
  </code></pre>
  
  <p>I read that this config is not appropiate for production. But I dont know how should configure the security. For example, Java writes on Realtime Database. </p>
  
  <p>Should I authenticate a user in Java and set the rules like this:</p>
  
  <pre><code>  {
      ".read": "$uid === auth.uid",
      ".write": "$uid === auth.uid"
    }
  </code></pre>
  
  <p>?</p>
  
  <p>Regards</p>
  
  <p>ER</p>