title: Using field in database security rule that is stored in the data
body: <p>I have a firebase database with the following structure</p>
  
  <p><a href="https://i.stack.imgur.com/n76VZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n76VZ.png" alt="enter image description here"></a></p>
  
  <p>I want to define a database rule where authenticated users can read the data only where authenticated user's id is equal to <code>userId</code> defined in the data.
  How can i define this rule?</p>
  
  <p>I have tried defining a rule as shown below but id didn't work. It doesn't allows any read operation</p>
  
  <pre><code>{
    "rules": {
      ".read": "auth.uid == root.child('orders').child('userId').val()",
      ".write": "auth != null"
    }
  }
  </code></pre>
  
  <p>This is how i am making a <code>GET</code> request to firebase's REST api</p>
  
  <pre><code>axios.get(`/orders.json?auth=${firebaseAuthToken}`)
          .then(response =&gt; {
              if (response.status === 200) {
                  dispatch(fetchOrdersSuccess(Object.values(response.data)));
              }
          })
          .catch(error =&gt; {
              dispatch(fetchOrdersError(error.message));
          });
  </code></pre>