How to prevent large strings from being updated to firebase database
I'm using vue.js with vuetify on a very simple Firebase database with user authentication.
I have a field called notes and I never want a user to submit more than 2,000 characters. I know I can use this.userInfo.notes.substring(0, 2000) but I think that is on the client, and I think it should be done on the server side.
I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.
I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.
Snippet
updateDatabase () {
database.ref('users').child(currentUserId).update({
notes: this.userInfo.notes || '',
Thanks,
firebase firebase-realtime-database vuejs2 vuetify.js edited Nov 12 at 10:18
PradyumanDixit
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
add a comment |
I'm using vue.js with vuetify on a very simple Firebase database with user authentication.
I have a field called notes and I never want a user to submit more than 2,000 characters. I know I can use this.userInfo.notes.substring(0, 2000) but I think that is on the client, and I think it should be done on the server side.
I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.
I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.
Snippet
updateDatabase () {
database.ref('users').child(currentUserId).update({
notes: this.userInfo.notes || '',
Thanks,
firebase firebase-realtime-database vuejs2 vuetify.js edited Nov 12 at 10:18
PradyumanDixit
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a<textarea maxlength="2000">for starters and then work from there.
– TommyF
Nov 11 at 17:54
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10
add a comment |
I'm using vue.js with vuetify on a very simple Firebase database with user authentication.
I have a field called notes and I never want a user to submit more than 2,000 characters. I know I can use this.userInfo.notes.substring(0, 2000) but I think that is on the client, and I think it should be done on the server side.
I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.
I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.
Snippet
updateDatabase () {
database.ref('users').child(currentUserId).update({
notes: this.userInfo.notes || '',
Thanks,
firebase firebase-realtime-database vuejs2 vuetify.js edited Nov 12 at 10:18
PradyumanDixit
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
I'm using vue.js with vuetify on a very simple Firebase database with user authentication.
I have a field called notes and I never want a user to submit more than 2,000 characters. I know I can use this.userInfo.notes.substring(0, 2000) but I think that is on the client, and I think it should be done on the server side.
I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.
I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.
Snippet
updateDatabase () {
database.ref('users').child(currentUserId).update({
notes: this.userInfo.notes || '',
Thanks,
firebase firebase-realtime-database vuejs2 vuetify.js firebase firebase-realtime-database vuejs2 vuetify.js edited Nov 12 at 10:18
PradyumanDixit
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
edited Nov 12 at 10:18
PradyumanDixit
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
edited Nov 12 at 10:18
PradyumanDixit
3,0742820
edited Nov 12 at 10:18
PradyumanDixit
3,0742820
edited Nov 12 at 10:18
PradyumanDixit
3,0742820
3,0742820
asked Nov 11 at 17:24
mrmccormack
368
asked Nov 11 at 17:24
mrmccormack
368
asked Nov 11 at 17:24
mrmccormack
368
368
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a<textarea maxlength="2000">for starters and then work from there.
– TommyF
Nov 11 at 17:54
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10
add a comment |
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a<textarea maxlength="2000">for starters and then work from there.
– TommyF
Nov 11 at 17:54
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a
<textarea maxlength="2000"> for starters and then work from there.– TommyF
Nov 11 at 17:54
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a
<textarea maxlength="2000"> for starters and then work from there.– TommyF
Nov 11 at 17:54
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10
add a comment |
1 Answer
1
active
oldest
votes
For server-side validation you use Firebase's security rules. A simple string length filter would look something like:
{
"rules": {
"users": {
"$uid": {
"notes": {
".validate": "newData.isString() && newData.val().length <= 2000"
}
}
}
}
}
Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error messagepermission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53251292%2fhow-to-prevent-large-strings-from-being-updated-to-firebase-database%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
For server-side validation you use Firebase's security rules. A simple string length filter would look something like:
{
"rules": {
"users": {
"$uid": {
"notes": {
".validate": "newData.isString() && newData.val().length <= 2000"
}
}
}
}
}
Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error messagepermission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51
add a comment |
For server-side validation you use Firebase's security rules. A simple string length filter would look something like:
{
"rules": {
"users": {
"$uid": {
"notes": {
".validate": "newData.isString() && newData.val().length <= 2000"
}
}
}
}
}
Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error messagepermission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51
add a comment |
For server-side validation you use Firebase's security rules. A simple string length filter would look something like:
{
"rules": {
"users": {
"$uid": {
"notes": {
".validate": "newData.isString() && newData.val().length <= 2000"
}
}
}
}
}
Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
For server-side validation you use Firebase's security rules. A simple string length filter would look something like:
{
"rules": {
"users": {
"$uid": {
"notes": {
".validate": "newData.isString() && newData.val().length <= 2000"
}
}
}
}
}
Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
answered Nov 11 at 18:15
Frank van Puffelen
227k28370396
227k28370396
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error messagepermission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51
add a comment |
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error messagepermission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31
It will give an error message
permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).– Frank van Puffelen
Nov 12 at 2:51
It will give an error message
permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).– Frank van Puffelen
Nov 12 at 2:51
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53251292%2fhow-to-prevent-large-strings-from-being-updated-to-firebase-database%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a
<textarea maxlength="2000">for starters and then work from there.– TommyF
Nov 11 at 17:54
Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10