angularjs - How to allow read/write objects only to authenticated user with Firebase? -

i trying make simple test of storing notes objects in firebase, user security rules ensure notes can read , write author.

here data stored in firebase looks like:

my_firebase_db - notes     - k835tw_h28xxb-sj4b         - text: "note 1 author 1",         - user_id: "11b09925-534b-4955-ac55-3e234809432f"     - k835tw_h28xxb-sj4b         - text: "note 1 author 2",         - user_id: "11b09925-534b-4955-ac55-4d223893382c"     - k835tw_h28xxb-sj4b         - text: "note 2 author 2",         - user_id: "11b09925-534b-4955-ac55-4d223893382c" 

angular code (angularfire) authenticates user custom token, load notes , method add note:

var ref = new firebase("https://xxx.firebaseio.com"); // authenticate users custom authentication token $firebaseauth(ref).$authwithcustomtoken(data.token).then(function(authdata) {       console.log("logged in as:", authdata.uid);       $scope.user_id = authdata.uid; }).catch(function(error) {       console.error("authentication failed:", error); });  // load notes $scope.notes = $firebasearray(ref.child('notes'));  $scope.addnote = function() {   note = {       user_id: $scope.user_id,       text: $scope.newnote.text   };   $scope.notes.$add(note); }; 

security & rules setup in firebase:

{   "rules": {     "notes": {       ".read": "auth != null && data.child('user_id').val() === auth.uid",       ".write": "auth != null && newdata.child('user_id').val() === auth.uid"     }   } } 

with these rules, read & write not allowed.

if change rules this, read & write allowed (but authors can read everybody's notes):

{   "rules": {     "notes": {       ".read": "auth != null",       ".write": "auth != null"     }   } } 

how can write security rule in firebase allow authenticated user read & write own notes?

turns out answer here: "rules not filters".