I'm not familiar with firebase, but am I reading correctly that rules cascade but without specificity rules?
How does cascading make sense at all if lower-down rules don't supersede higher rules?
How does cascading make sense at all if lower-down rules don't supersede higher rules?
But whatever Firebase is doing, it’s the opposite of specificity - it’s closer to “search top down until we find something truthy then stop.” https://firebase.google.com/docs/database/security/
This is simpler and more efficient to implement and run at scale. But imagine if styling worked like that - you could never have colored overlays, or anything we take for granted.
When over-eager marketing speak encourages insecurity, it’s a significant ethical breach.
I do think that if this is such a common behavior the rules DSL could be revised so that fewer people fall down the "pit of success". At the very least do not allow people to define rules that have already been defined by parents. This should be part of Firebase, the fact that theres a startup providing this service is the biggest code smell I can think of telling you there's a problem here.
> Note that .read and .write rules shallower in the database override deeper rules, so read access to /foo/bar/baz would still be granted in this example even if a rule at the path /foo/bar/baz evaluated to false.
https://firebase.google.com/docs/database/security/
This seems unreasonable at first glance. Does anyone know the rationale for it?