Firebase Security Rules: Public vs. Private Data

Solution 1:

With respect to security rules, Firebase operations are all-or-nothing.

As a result, attempting to load all of the data at /signatures will fail because your client does not have permission to read all of the data at that location, though you do have permission to read some of the data there. Similarly, writing to a location behaves the same way, and full permission is required before your operation will continue.

To handle this use case, consider restructuring your data like this:

{
  "rules": {
    ".read": false,
    ".write": false, 
    "signatures-public": {
      ".read": true,
      "$signatureID": {
        // ... public data here
      }
    },
    "signatures-private": {
      "$signatureID": {
        // ... private data here
      }
    }
  }
}