Role-Based Access Control Fundamentals in Firebase Quiz

This quiz explores key concepts of role-based access control (RBAC) within Firebase, such as roles, permissions, security rules, and best practices for data security. Reinforce your understanding of how to structure user access and protect resources using custom roles and rule-based policies.

1. Identifying User Roles

   Which principle describes assigning different access privileges to users based on their assigned role, such as 'admin', 'editor', or 'viewer'?

   1. Role-Based Access Control
   2. Time-Based Access Policy
   3. Database Indexing
   4. Static Key Authentication

   Explanation: Role-Based Access Control (RBAC) organizes permissions around user roles and allows assigning specific capabilities to users. Time-Based Access Policy relates to access windows but does not involve roles. Static Key Authentication is about secret usage for access, not role assignments. Database Indexing deals with query performance rather than access privileges.

2. Purpose of 'Custom Claims'

   When adding role information to a user's token for access control, which Firebase feature allows you to set fields like 'admin' or 'moderator' on the user's ID token?

   1. Custom Claims
   2. Session Refresh
   3. Realtime Triggers
   4. Cloud Messaging

   Explanation: Custom Claims allow you to include role-related attributes within a user's authentication token, facilitating access decisions based on roles. Realtime Triggers are for event handling, not token information. Cloud Messaging is for sending notifications, and Session Refresh relates to token renewal, not role management.

3. Role Checking in Security Rules

   In a security rule, how can you check if an authenticated user has an 'admin' role using custom claims?

   1. claims.admin equals 1
   2. request.token.admin == 'yes'
   3. request.auth.token.admin == true
   4. user.admin exists

   Explanation: The correct way to check for a custom claim is by using 'request.auth.token.admin == true' in the security rule, as this directly accesses the claim in the authenticated user's token. 'request.token.admin == 'yes'' is invalid syntax. 'user.admin exists' is not a valid path. 'claims.admin equals 1' incorrectly refers to a variable not present in security rules.

4. Default Access Without Rules

   What is the access level for a new Firebase database if no security rules are set?

   1. Access only for authenticated users
   2. Only the owner can read and write
   3. No one can access the database
   4. Open access to all users

   Explanation: By default, without security rules, the database is open and accessible to anyone, which is not secure for production. Access for only authenticated users is enabled when rules are set to require authentication. 'No one can access' only happens if rules explicitly deny access. 'Only the owner' refers to local file ownership, not database security.

5. Least Privilege in RBAC

   Why is the principle of 'least privilege' important when assigning roles in your Firebase project?

   1. It prevents users from being assigned any roles
   2. It allows unlimited access by default
   3. It grants all permissions to every user
   4. It limits users to only the permissions they need

   Explanation: The 'least privilege' principle ensures users have only the permissions necessary for their tasks, minimizing risks. Granting all permissions defeats the purpose of secure access control. Preventing role assignment would stop legitimate use. Unlimited access is the opposite of restricting privileges.

6. Example of Role Hierarchy

   If your project has 'admin', 'editor', and 'viewer' roles, with each having different permissions, what concept allows 'admin' to do everything that 'editor' can do, plus more?

   1. Session Timeout
   2. Token Encryption
   3. Data Replication
   4. Role Hierarchy

   Explanation: Role Hierarchy describes a structure where higher-level roles inherit permissions from lower-level ones, making it easier to manage access. Session Timeout is about user sessions, not permissions. Token Encryption refers to securing tokens, not roles. Data Replication manages data copies, unrelated to permissions.

7. Assigning a Role to a User

   What is a common method for assigning a user the 'moderator' role so that security rules can recognize this role?

   1. Add a custom claim to the user's authentication token
   2. Store the role in a public document
   3. Add the role as a query parameter in URLs
   4. Include the role in an email subject

   Explanation: Assigning a role via custom claim in the user's token is secure and easily referenced in security rules. Public documents are unsafe for role information. Email subjects and URL parameters are not secure or recognized ways for role assignment in access control.

8. Setting Read-Only Access

   If you want to allow only users with the 'viewer' role to read data but not write, how should you configure your security rules?

   1. Set both 'read' and 'write' to true for all users
   2. Allow 'write' if request.auth.token.viewer is true
   3. Deny everything for users with a role
   4. Grant 'read' permission only if request.auth.token.viewer is true and deny 'write'

   Explanation: Giving 'read' permission based on the 'viewer' role and denying 'write' maintains proper access. Allowing both read and write for all users ignores role distinctions. Permitting 'write' for viewers is incorrect. Denying all access for users with roles removes legitimate access.

9. Handling Unauthenticated Users

   Which security rule pattern prevents unauthenticated users from accessing data by checking if the user is signed in?

   1. request.auth != null
   2. request.token.signedUser == true
   3. data.isLoggedIn == true
   4. allow: login

   Explanation: Checking 'request.auth != null' ensures only authenticated users can proceed, blocking guests. 'request.token.signedUser == true' is not standard syntax. 'data.isLoggedIn == true' refers to data, not authentication. 'allow: login' is not a valid security rule statement.

10. Updating User Roles Securely

    What is a recommended way to safely update user roles, such as adding or removing 'admin', in a production environment?

    1. Send role updates via email
    2. Update the user's role using client-side JavaScript
    3. Use a trusted server to set custom claims
    4. Hardcode roles in a mobile app

    Explanation: A trusted server ensures that only authorized personnel or backend processes can update roles securely, reducing risk of tampering. Client-side JavaScript can be manipulated and is insecure. Emails are not a direct or secure way to manage roles. Hardcoding roles in mobile apps prevents dynamic role changes and weakens security.