How to fix database/permission-denied in Firebase

FirebaseINTERMEDIATEHIGHUpdated Dec 22, 2025· 129 views

The "database/permission-denied" error occurs when your client lacks authorization to access Firebase Realtime Database. This is commonly due to unauthenticated access, overly restrictive security rules, or authentication state sync issues. Fix it by implementing Firebase Authentication and configuring proper security rules.

Quick fix

Fixes PERMISSION_DENIED

import { getAuth, onAuthStateChanged } from "firebase/auth";
import { getDatabase, ref, get } from "firebase/database";

const auth = getAuth();
const db = getDatabase();

onAuthStateChanged(auth, async (user) => {
  if (user) {
    // User is authenticated, safe to access database
    const dataRef = ref(db, "users/" + user.uid);
    const snapshot = await get(dataRef);
    console.log(snapshot.val());
  } else {
    console.log("User not authenticated");
  }
});
  1. Check if user is authenticated
  2. Review and update security rules
  3. Use the Rules Playground to validate
  4. Verify authentication before operations
firebase — error
import { getAuth, onAuthStateChanged } from "firebase/auth";
import { getDatabase, ref, get } from "firebase/database";
const auth = getAuth();
const db = getDatabase();
onAuthStateChanged(auth, async (user) => {
  if (user) {
    // User is authenticated, safe to access database
    const dataRef = ref(db, "users/" + user.uid);
    const snapshot = await get(dataRef);
    console.log(snapshot.val());
  } else {
    console.log("User not authenticated");
  }
});
database/permission-denied

What this error means

This error means Firebase servers rejected your read or write operation because your security rules do not permit the access. Firebase Realtime Database enforces security rules on the server side before any data operation occurs—no client-side workaround can bypass them. The error typically indicates one of three issues: (1) the user is not authenticated when the rules require authentication, (2) the security rules explicitly deny access to the requested path, or (3) there is a timing mismatch where the client attempts database access before authentication completes.

Typical symptoms

  • All database read or write operations fail with "permission denied" error
  • Error appears as: "DatabaseError: Permission denied" or "@firebase/database: FIREBASE WARNING: set at [path] failed: permission_denied"
  • Operations work in Firebase Console Rules Playground but fail in your app
  • Database access succeeds sometimes (like while app is running) but fails after restart
  • Only specific paths trigger the error while others work fine

Common causes

  1. User is not authenticated when security rules require auth (most common)
  2. Security rules deny read/write access to the requested path
  3. User is authenticated but lacks permission for their specific user ID or role
  4. Authentication state has not fully synced before database operation (race condition)
  5. Using wrong database URL or database region mismatch
  6. SDK version issue where auth state is not persisted after app restart

How to fix "database/permission-denied"

1Check if user is authenticated

Before any database operation, verify that the user is logged in. Use onAuthStateChanged() to wait for auth to complete:

javascript
import { getAuth, onAuthStateChanged } from "firebase/auth";
import { getDatabase, ref, get } from "firebase/database";

const auth = getAuth();
const db = getDatabase();

onAuthStateChanged(auth, async (user) => {
  if (user) {
    // User is authenticated, safe to access database
    const dataRef = ref(db, "users/" + user.uid);
    const snapshot = await get(dataRef);
    console.log(snapshot.val());
  } else {
    console.log("User not authenticated");
  }
});

Do NOT attempt database operations in the root of your app or before onAuthStateChanged fires.

2Review and update security rules

Go to Firebase Console > Realtime Database > Rules tab. Start with secure defaults and grant minimum permissions:

json
{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

Replace $uid with your actual path variable. This rule allows users to only read/write their own data where the path matches their Firebase UID.

Never use this for testing (even temporarily):

json
{ "rules": { ".read": true, ".write": true } }

This makes your database publicly writable—any attacker can delete all your data.

3Use the Rules Playground to validate

In Firebase Console, select the Rules tab and click "Rules Playground" (or refresh the page after editing rules). Simulate a read/write operation with a specific user ID:

1. Select "Simulate read" or "Simulate write"
2. Enter the path (e.g., /users/user123)
3. In the auth section, paste a mock user object: { "uid": "user123" }
4. Click "Run"

The playground will tell you exactly which rule lines allowed or denied the operation. If it's denied, adjust your rules before publishing.

4Verify authentication before operations

Wrap database operations in a guard that checks auth.currentUser:

javascript
import { getAuth } from "firebase/auth";
import { getDatabase, ref, set } from "firebase/database";

const auth = getAuth();
const db = getDatabase();

async function saveUserData(data) {
  if (!auth.currentUser) {
    throw new Error("User must be signed in");
  }
  
  const uid = auth.currentUser.uid;
  const userRef = ref(db, "users/" + uid);
  await set(userRef, data);
}

This ensures the user is authenticated before attempting any write, catching the problem before Firebase rejects it.

5Check database URL and region

Verify you're using the correct database URL:

1. Go to Firebase Console > Realtime Database
2. Copy the Database URL (e.g., https://my-project.firebaseio.com)
3. Initialize Firebase with the correct config:

javascript
import { initializeApp } from "firebase/app";
import { getDatabase } from "firebase/database";

const firebaseConfig = {
  apiKey: "...",
  projectId: "my-project",
  databaseURL: "https://my-project.firebaseio.com",
  // ... other config
};

const app = initializeApp(firebaseConfig);
const db = getDatabase(app);

If your database is in a different region, ensure the URL matches. A region mismatch can cause "Client doesn't have permission to access the desired data" errors.

Advanced notes

Authentication Timing: In some SDKs (especially mobile), there is a known timing issue where authentication state may not persist after the app restarts. If you're experiencing permission denied only after a restart, ensure you're using the latest SDK version (Firebase Android SDK 34.0.1+ or equivalent). Also, defer database operations until onAuthStateChanged has fired at least once.

Atomicity: Realtime Database performs atomic read operations. If you're reading from /records/ and any child node is denied by your rules, the entire read operation fails with permission denied. This is different from Firestore—you cannot partially read data. Design your rules to match your read access patterns.

Service Account Access: If you're accessing the database from a backend (Node.js, Cloud Functions), use a service account instead of client auth. Initialize Firebase Admin SDK:

javascript
const admin = require("firebase-admin");
admin.initializeApp();
const db = admin.database();
await db.ref("users/123").set({ name: "John" });

Service accounts bypass client-side security rules and use database rules instead (if configured). Be very careful with this approach.

Frequently asked questions

What does "PERMISSION_DENIED" mean?
This error means Firebase servers rejected your read or write operation because your security rules do not permit the access. Firebase Realtime Database enforces security rules on the server side before any data operation occurs—no client-side workaround can bypass them. The error typically indicates one of three issues: (1) the user is not authenticated when the rules require authentication, (2) the security rules explicitly deny access to the requested path, or (3) there is a timing mismatch where the client attempts database access before authentication completes.
How do I fix "PERMISSION_DENIED"?
The "database/permission-denied" error occurs when your client lacks authorization to access Firebase Realtime Database. This is commonly due to unauthenticated access, overly restrictive security rules, or authentication state sync issues. Fix it by implementing Firebase Authentication and configuring proper security rules.
What causes "PERMISSION_DENIED"?
User is not authenticated when security rules require auth (most common) Security rules deny read/write access to the requested path User is authenticated but lacks permission for their specific user ID or role
Is the "PERMISSION_DENIED" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading