Firebase in NodeJS with HTTP Proxy

Previously, Firebase required you to generate your own indexes or download all data at a location to find and retrieve elements that matched some child attribute (for example, all users with name === "Alex").

In October 2014, Firebase rolled out new querying functionality via the orderByChild() method, that enables you to do this type of query quickly and efficiently. See the updated answer below.

When writing data to Firebase, you have a few different options which will reflect different use cases. At a high level, Firebase is a tree-structured NoSQL data store, and provides a few simple primitives for managing lists of data:

1. Write to Firebase with a unique, known key:

   ref.child('users').child('123').set({ "first_name": "rob", "age": 28 })
   

2. Append to lists with an auto-generated key that will automatically sort by time written:

   ref.child('users').push({ "first_name": "rob", "age": 28 })
   

3. Listen for changes in data by its unique, known path:

   ref.child('users').child('123').on('value', function(snapshot) { ... })
   

4. Filter or order data in a list by key or attribute value:

   // Get the last 10 users, ordered by key
   ref.child('users').orderByKey().limitToLast(10).on('child_added', ...)
   
   // Get all users whose age is >= 25
   ref.child('users').orderByChild('age').startAt(25).on('child_added', ...)
   

With the addition of orderByChild(), you no longer need to create your own index for queries on child attributes! For example, to retrieve all users with the name "Alex":

ref.child('users').orderByChild('name').equalTo('Alex').on('child_added',  ...)

Engineer at Firebase here. When writing data into Firebase, you have a few different options which will reflect different application use cases. Since Firebase is a NoSQL data store, you will need to either store your data objects with unique keys so that you can directly access that item or load all data at a particular location and loop through each item to find the node you're looking for. See Writing Data and Managing Lists for more information.

When you write data in Firebase, you can either set data using a unique, defined path (i.e. a/b/c), or push data into a list, which will generate a unique id (i.e. a/b/<unique-id>) and allow you to sort and query the items in that list by time. The unique id that you're seeing above is generated by calling push to append an item to the list at online-b-cards/users.

Rather than using push here, I would recommend using set, and storing the data for each user using a unique key, such as the user's email address. Then you can access the user's data directly by navigating to online-b-cards/users/<email> via the Firebase JS SDK. For example:

function escapeEmailAddress(email) {
  if (!email) return false

  // Replace '.' (not allowed in a Firebase key) with ',' (not allowed in an email address)
  email = email.toLowerCase();
  email = email.replace(/\./g, ',');
  return email;
}

var usersRef = new Firebase('https://online-b-cards.firebaseio.com/users');
var myUser = usersRef.child(escapeEmailAddress('hello@hello.com')) 
myUser.set({ email: 'hello@hello.com', name: 'Alex', phone: 12912912 });

Note that since Firebase does not permit certain characters in references (see Creating References), we remove the . and replace it with a , in the code above.

The URL cannot parse json. It's just a string of text. Simply include the token directly.

curl -X https://INSTANCE.firebaseio.com/users/jack.json?auth=zXRLa7lybhJ21ZYqpXuqkT6YAYyySAGJ10lXInKy  // not { auth: '...' }

When you use your firebase secret in the URL, security rules are not applied. The secret allows you full read/write access without regard to security rules or validation. So there is no need to read anything into your security rules.

When working with tokens, you do not refer to the security token itself. That is an encrypted json object and the contents are what are available in security rules.

To understand what is taking place here, you will want a rudimentary understanding of tokens. At a bare minimum, this requires reading the security quickstart from top to bottom, and the section about the auth variable from top to bottom.

In the auth variable section, you will find this example:

var token = tokenGenerator.createToken({"app_user_id": 1234, "isModerator": true });

Note that the contents of the token are app_user_id and isModerator. You can now refer to those two variables in security rules:

".read": "auth.isModerator === true"

You can also develop a better understanding of tokens by fiddling with them here; allows you to create and break down tokens to see what is inside of them, as well as validating them against your namespace to make sure they function.