title: Firebase ignoring security rules when using secret
body: <p>I am attempting to apply some security rules to our firebase instance, but I do not seem to be able to get calls from iOS to respect them. I started with a simple test that verifies authentication (should succeed), and then attempts to write an undefined value to the root (should fail).</p>
  
  <p>Rules:</p>
  
  <pre><code>{
    "rules": 
    {
      //Default read and write access to authenticated users only
      ".read" : "auth != null",
      ".write" : "auth != null",
  
      //Prevent undefined child variables
      "$undef" : { ".validate" : false  }
    }
  }
  </code></pre>
  
  <p>Login:</p>
  
  <pre><code>- (void)authenticate
  {
      [_dataRef authWithCredential:SECURITY_CREDENTIAL //Firebase Secret JSON token
       withCompletionBlock:^(NSError *error, id data){}
       withCancelBlock:^(NSError *error)
       {
            //If the authentication becomes invalid, re-authenticate
            [self authenticate];
       }];
  }
  </code></pre>
  
  <p>Write test:</p>
  
  <pre><code>[[[[Firebase alloc] initWithUrl:ROOT_URL] childByAppendingPath:CHILD_PATH] setValue:VALUE];
  </code></pre>
  
  <p>Now what I cant seem to figure out is why the simulator correctly fails to write this value, but iOS ignores the validation and writes the data. </p>
  
  <p>Also upon further testing I ran into a second issue that spawned from this one. If I change the credential I use to authenticate to something that is not a valid firebase secret token, iOS will correctly fail auth, but the simulator with authenticate as long as I pass it any string. Is that right?</p>