firebase security rules not working as expected

Question

i'm trying to understand how security rules structure is working. I have these rules:

{
    "rules": {
        "level1": { //public info
            ".read": true,
            ".write": true,
            "level2": { //private info
              ".read": false,
              ".write": false
              }
        }
    }
}

then testing with simulator i expected to have r/w access to level1, and NOT to level2...

but result was i have r/w access to both levels. How is that? Am i missing something?

Thanks.

Answer 1

When you grant (read or write) access on one level, you can not revoke access on a lower level. See this quote from the Firebase documentation on security:

Rules Cascade

SECURITY AND FIREBASE RULES WORK FROM THE TOP-DOWN

This is a critical concept of understanding Security and Firebase Rules. The child rules can only grant additional privileges to what parent nodes have already declared. They cannot revoke a read or write privilege.