title: Firebase Security Issues - How to Have One User Change Another's DB Object?
body: <p>I'm building an HTML/JavaScript/CSS front-end application using only Firebase as my backend (and I'd like to keep it that way, but I'm not sure if what I want to do is possible without another server).</p>
  
  <p>I'm trying to implement a following/followers functionality. I have a node in the Firebase database that is basically a list of users. The object key is the user's auth uid, and the value is an object describing properties of that user object. </p>
  
  <p><a href="https://i.stack.imgur.com/EyYhJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EyYhJ.png" alt="enter image description here"></a></p>
  
  <p>I want to have a "follow" button in my app that, when clicked, adds an object with the uid of the user being followed to the "following" object of the current user. Also, I want to add an object with the current user's uid to the "followers" node of the user being followed. </p>
  
  <p>followers node:</p>
  
  <p><a href="https://i.stack.imgur.com/XY5oh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XY5oh.png" alt="enter image description here"></a></p>
  
  <p>following node:</p>
  
  <p><a href="https://i.stack.imgur.com/OM9mV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OM9mV.png" alt="enter image description here"></a></p>
  
  <p>The trouble I'm having is that Firebase recommends to set up their security rules something like this:</p>
  
  <pre><code>{
    "rules": {
      "users": {
        "$uid": {
          ".write": "$uid === auth.uid"
        }
      }
    }
  }
  </code></pre>
  
  <p>This way it's fine to expose your firebase key because any given authenticated user can only write to his own object in the database. So my question is: What's the best way for me to allow one user to modify another's database object (by writing to the other user's "followers" node) while still preventing anyone with my Firebase key from maliciously writing to any/every user's object?</p>