How to fix database/permission-denied in Firebase

Before any database operation, verify that the user is logged in. Use onAuthStateChanged() to wait for auth to complete:

import { getAuth, onAuthStateChanged } from "firebase/auth";
import { getDatabase, ref, get } from "firebase/database";

const auth = getAuth();
const db = getDatabase();

onAuthStateChanged(auth, async (user) => {
  if (user) {
    // User is authenticated, safe to access database
    const dataRef = ref(db, "users/" + user.uid);
    const snapshot = await get(dataRef);
    console.log(snapshot.val());
  } else {
    console.log("User not authenticated");
  }
});

Do NOT attempt database operations in the root of your app or before onAuthStateChanged fires.

Go to Firebase Console > Realtime Database > Rules tab. Start with secure defaults and grant minimum permissions:

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Replace $uid with your actual path variable. This rule allows users to only read/write their own data where the path matches their Firebase UID.

Never use this for testing (even temporarily):

{ "rules": { ".read": true, ".write": true } }

This makes your database publicly writable—any attacker can delete all your data.

In Firebase Console, select the Rules tab and click "Rules Playground" (or refresh the page after editing rules). Simulate a read/write operation with a specific user ID:

1. Select "Simulate read" or "Simulate write"
2. Enter the path (e.g., /users/user123)
3. In the auth section, paste a mock user object: { "uid": "user123" }
4. Click "Run"

The playground will tell you exactly which rule lines allowed or denied the operation. If it's denied, adjust your rules before publishing.

Wrap database operations in a guard that checks auth.currentUser:

import { getAuth } from "firebase/auth";
import { getDatabase, ref, set } from "firebase/database";

const auth = getAuth();
const db = getDatabase();

async function saveUserData(data) {
  if (!auth.currentUser) {
    throw new Error("User must be signed in");
  }
  
  const uid = auth.currentUser.uid;
  const userRef = ref(db, "users/" + uid);
  await set(userRef, data);
}

This ensures the user is authenticated before attempting any write, catching the problem before Firebase rejects it.

Verify you're using the correct database URL:

1. Go to Firebase Console > Realtime Database
2. Copy the Database URL (e.g., https://my-project.firebaseio.com)
3. Initialize Firebase with the correct config:

import { initializeApp } from "firebase/app";
import { getDatabase } from "firebase/database";

const firebaseConfig = {
  apiKey: "...",
  projectId: "my-project",
  databaseURL: "https://my-project.firebaseio.com",
  // ... other config
};

const app = initializeApp(firebaseConfig);
const db = getDatabase(app);

If your database is in a different region, ensure the URL matches. A region mismatch can cause "Client doesn't have permission to access the desired data" errors.