Adding Security to Firebase to prevent the insertion of additional data
<p>I have a field within Firebase called 'pending_members' which contains a list of members pending permission to be granted by an 'owner', as such, 'pending_members' requires the following rules:</p>

<ol>
<li>The current user can only add themselves (uid)</li>
<li>The current user can remove only themselves (uid) from the list</li>
<li>The 'owner' can remove any member from the list</li>
<li>Only the 'owner' can read the list</li>
</ol>

<p>I've tried various security rules but seem to miss many corner cases, for example, a user is given write access because the data contains their uid but they can then submit someone else's uid along with this.</p>

<p>Can anyone suggest appropriate rules for this situation? Many thanks</p>

<pre><code>"pending_members" : {
    ".write" : "auth !== null &amp;&amp; 
        // The user is authenticated AND
        (newData.child(auth.uid).exists() ||
        // The new data contains either the current user's id OR
        (!newData.exists() &amp;&amp;  
        // There's no new data (a delete operation) AND
        data === auth.uid))",
        // The old data is the current user's id

"$member" : {
    ".validate" : "newData.isString()",
        "$other": { ".write": false, ".read": false }
    }
}
</code></pre>

<p><strong>Edit:</strong>
Structure Example:</p>

<pre><code>users       -&gt;
                personal_data   -&gt;
                                    email                   (user email address)
                                    first_name              (user first name)
                                    last_name               (user last name)
                networks_index  -&gt;
networks    -&gt;
                members                 (list of uids of users linked to the network)
                owner                   (uid of the owner/primary user)
                pending_members         (list of uids of users wishing to link to the network)
</code></pre>

<p><a href="http://i.stack.imgur.com/ZDtLi.png" rel="nofollow">Data Example (image)</a></p>