title: Firebase check if logged in user is writing to database
body: <p>I need to make sure that every push to the Firebase database is indeed the same person who is logged in. You can intercept requests and change the ID and make it look like somebody else posted it.. How can I prevent this?</p>
  
  <p>This is what I've tried, but it fails <code>permission denied</code>:</p>
  
  <p><strong>EDIT</strong>: added .write</p>
  
  <p><strong>deleted</strong></p>
  
  <p><strong>EDIT2:</strong>
  Adding a new question when user is logged in:</p>
  
  <pre><code>var newQuestion = Firebase.database().ref("/questions");
  var user = Firebase.auth().currentUser;
  newQuestion.push({
    title: this.props.question,
    userId: user.uid,
    user: user.displayName,
    time: moment().format(),
    answers: this.props.answers
  })
  </code></pre>
  
  <p>What I want is a rule that checks if the logged in user is still the user that is posting the question. In other words, no one can post in your name by 'stealing' your uid.</p>
  
  <p>Rule:</p>
  
  <pre><code>{
    "rules": {
      ".read": "auth != null",
      "questions":{
        "$question_id":{
           ".write": "auth != null &amp;&amp; auth.uid == newData.child('userId').isString()"
        }
      }
    }
  }
  </code></pre>
  
  <p>Error:</p>
  
  <blockquote>
    <p>FIREBASE WARNING: set at /questions/-KTyWyapvfsIzqoe6gmp failed:
    permission_denied
    Possible Unhandled Promise Rejection (id: 0):
    PERMISSION_DENIED: Permission denied
    Error: PERMISSION_DENIED: Permission denied</p>
  </blockquote>