How to prevent large strings from being updated to firebase database

I'm using vue.js with vuetify on a very simple Firebase database with user authentication.

I have a field called notes and I never want a user to submit more than 2,000 characters. I know I can use this.userInfo.notes.substring(0, 2000) but I think that is on the client, and I think it should be done on the server side.

I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.

I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.

Snippet

updateDatabase () {

  database.ref('users').child(currentUserId).update({

    notes: this.userInfo.notes || '',

Thanks,

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a <textarea maxlength="2000"> for starters and then work from there.
– TommyF
Nov 11 at 17:54

Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10

add a comment |

I'm using vue.js with vuetify on a very simple Firebase database with user authentication.

I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.

I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.

Snippet

updateDatabase () {

  database.ref('users').child(currentUserId).update({

    notes: this.userInfo.notes || '',

Thanks,

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a <textarea maxlength="2000"> for starters and then work from there.
– TommyF
Nov 11 at 17:54

Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10

add a comment |

I'm using vue.js with vuetify on a very simple Firebase database with user authentication.

I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.

I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.

Snippet

updateDatabase () {

  database.ref('users').child(currentUserId).update({

    notes: this.userInfo.notes || '',

Thanks,

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

I'm using vue.js with vuetify on a very simple Firebase database with user authentication.

I thought that all firebase apps would restrict the maxlength for updates, but I couldn't find examples.

I see https://firebase.google.com/docs/reference/security/database/#newdata but not sure how to use.

Snippet

updateDatabase () {

  database.ref('users').child(currentUserId).update({

    notes: this.userInfo.notes || '',

Thanks,

firebase firebase-realtime-database vuejs2 vuetify.js

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

edited Nov 12 at 10:18

PradyumanDixit

3,0742820

asked Nov 11 at 17:24

mrmccormack

368

asked Nov 11 at 17:24

mrmccormack

368

asked Nov 11 at 17:24

mrmccormack

368

What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a <textarea maxlength="2000"> for starters and then work from there.
– TommyF
Nov 11 at 17:54

Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10

add a comment |

What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a <textarea maxlength="2000"> for starters and then work from there.
– TommyF
Nov 11 at 17:54

Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10

What is supposed to happen if the user does enter more than 2000 characters? I think this is very well client-side logic and should first and foremost be handled on the client side. Only if you are really concerned about somebody circumventing your client side logic for this, you should also handle it on the server side as well. Use a <textarea maxlength="2000"> for starters and then work from there.
– TommyF
Nov 11 at 17:54

Thanks... if >2000, I'll just truncate it the string.... I'm also using quilljs.com and there are client side solutions for that as well. I do want to have all field updates restricted by length, textarea, input type=text, and quill. - I'm under the impression that client side solutions are easily by-passed (or perhaps I'm worrying about nothing). I will put max length on the fields I can... thanks, Rob
– mrmccormack
Nov 11 at 18:10

add a comment |

1 Answer
1

active

oldest

votes

For server-side validation you use Firebase's security rules. A simple string length filter would look something like:

{

  "rules": {

    "users": {

      "$uid": {

        "notes": {

          ".validate": "newData.isString() && newData.val().length <= 2000"

        }

      }

    }

  }

}

Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53251292%2fhow-to-prevent-large-strings-from-being-updated-to-firebase-database%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

For server-side validation you use Firebase's security rules. A simple string length filter would look something like:

{

  "rules": {

    "users": {

      "$uid": {

        "notes": {

          ".validate": "newData.isString() && newData.val().length <= 2000"

        }

      }

    }

  }

}

Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

add a comment |

For server-side validation you use Firebase's security rules. A simple string length filter would look something like:

{

  "rules": {

    "users": {

      "$uid": {

        "notes": {

          ".validate": "newData.isString() && newData.val().length <= 2000"

        }

      }

    }

  }

}

Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

add a comment |

For server-side validation you use Firebase's security rules. A simple string length filter would look something like:

{

  "rules": {

    "users": {

      "$uid": {

        "notes": {

          ".validate": "newData.isString() && newData.val().length <= 2000"

        }

      }

    }

  }

}

Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

For server-side validation you use Firebase's security rules. A simple string length filter would look something like:

{

  "rules": {

    "users": {

      "$uid": {

        "notes": {

          ".validate": "newData.isString() && newData.val().length <= 2000"

        }

      }

    }

  }

}

Also see: https://firebase.google.com/docs/database/security/securing-data#predefined_variables

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

answered Nov 11 at 18:15

Frank van Puffelen

227k28370396

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

add a comment |

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

Thanks Frank, I'll give that a try.... Will this trigger an error message, or just truncate the string to 2000 characters and insert into Firebase database...
– mrmccormack
Nov 11 at 20:31

It will give an error message permission denied. For the best user experience you should also validate the same condition in the client, and give a more meaningful message (and refuse to send).
– Frank van Puffelen
Nov 12 at 2:51

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Wsrtjtyk