question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Error message improvement for testing security rules

See original GitHub issue

Environment info

  • Operating System version: Fedora 32
  • Browser version: Firefox 79
  • Firebase SDK version: 0.20.11
  • Firebase: 8.9.0
  • Firebase Product: Firestore, Emulator
  • node: v14.8.0
  • npm: 6.14.7

Test case

package.json

{
  "name": "security_rules",
  "version": "1.0.0",
  "description": "Unit testing for security rules",
  "main": "test.js",
  "scripts": {
    "test": "mocha --exit"
  },
  "author": "me",
  "license": "ISC",
  "devDependencies": {
    "@firebase/testing": "^0.20.11",
    "mocha": "^8.1.1"
  }
}

firestore_rules.json

rules_version = '1';
service cloud.firestore {
  match /databases/{database}/documents {
      match /{document=**} {
        allow read: if false;
        allow write: if false;
      }
}

test,js

const assert = require('assert');
const firebase = require("@firebase/testing");

const PROJECT_ID = "asd";
const myId = "user_abc";
const theirId = "user_xyz";
const myAuth = {uid: myId, email: "abc@example.com"};

function getFireStore(myAuth){
    return firebase.initializeTestApp({projectId: PROJECT_ID, auth: myAuth}).firestore();
}

function getFireStoreAdmin(){
    return firebase.initializeAdminApp({projectId: PROJECT_ID}).firestore();
}

beforeEach(async() => {
    await firebase.clearFirestoreData({projectId: PROJECT_ID});
});

describe("asd app", () => {

    it("get doc from firestore", async() => {
        const db = getFireStore(null);
        const testDoc = db.collection("readonly").doc("testDoc");
        await firebase.assertSucceeds(testDoc.get());
    });
})

Steps to reproduce

firebase emulators:start

npm test

Expected behavior

A clear error message what is wrong. Something like FirebaseError: PERMISSION_DENIED because security rules returned false for 'get' @ L5

Actual behavior

Running Security Rule Test fails with following unclear error:

FirebaseError: false for 'get' @ L5 at new FirestoreError (node_modules/@firebase/firestore/dist/index.node.cjs.js:1205:28) at fromRpcStatus (node_modules/@firebase/firestore/dist/index.node.cjs.js:5240:12) at fromWatchChange (node_modules/@firebase/firestore/dist/index.node.cjs.js:5476:35) at PersistentListenStream.onMessage (node_modules/@firebase/firestore/dist/index.node.cjs.js:15743:27) at /home/roman/projects/asd/test/security_rules/node_modules/@firebase/firestore/dist/index.node.cjs.js:15676:30 at /home/roman/projects/asd/test/security_rules/node_modules/@firebase/firestore/dist/index.node.cjs.js:15712:28 at /home/roman/projects/asd/test/security_rules/node_modules/@firebase/firestore/dist/index.node.cjs.js:14143:20 at processTicksAndRejections (internal/process/task_queues.js:93:5)

Issue Analytics

  • State:open
  • Created 3 years ago
  • Reactions:18
  • Comments:7 (2 by maintainers)

github_iconTop GitHub Comments

8reactions
BossBelecommented, Apr 29, 2021

+1

5reactions
trullockcommented, Feb 15, 2021

+1 for this, just spent ages trying to understand what false for get meant…

Read more comments on GitHub >

github_iconTop Results From Across the Web

Testing for Improper Error Handling - OWASP Foundation
OWASP is a nonprofit foundation that works to improve the security of software. ... In order to trigger error messages, a tester must:....
Read more >
Error Handling Flaws - Information and How to Fix - Veracode
Error messages in web apps provide valuable insights into issues and problems. It is critical to have proper error handling to prevent security...
Read more >
Error Messages and How to Improve Them - ThinkTesting.com
“The guidelines for creating effective error messages have been the same for 20 years.” Jakob Nielsen, 'Error Message Guidelines'.
Read more >
Thoughtful Error Handling - Medium
This blog post is part of a series on secure coding principles that may ... While testing the API I noticed that one...
Read more >
Error Messages: Examples, Best Practices & Common Mistakes
1. Ambiguity · 2. Condescending language/blaming the user · 3. Poor placement of error messages · 4. Unclear expectations.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found