Firebase permissions: Sign up with username and password - ios

Question

I'd like to have my users sign up with a unique username and password (rather than email + password). I have everything working where I:
Sign up
Check if the provided username already exists
If not, then use FIRAuth.auth()?.createUserWithEmail and store the username in the db with the email, e.g.
users
QZqFzWxpdMfc0xmyIq5IDAr1bzr2
credentials
email: "myemail#gmail.com"
username: "MyUsername"
RJasdfasfasdad3dadaewdsdkdq3dk
credentials
email: "another#gmail.com"
username: ""Another
Sign in
Query the db to get User associated with the username and use that to get the email address and use FIRAuth.auth()?.signIn(withEmail: withEmail to log in
While this approach work, I'm wondering how this would work with Firebase permissions?
In order to get the email address associated with the username, I'm going to have to let all users access my email address / username data, e.g.
{
"rules": {
".read": true,
".write": "auth != null"
}
}
Does this mean that a 'hacker' could get the email addresses of all the users who have registered with my app? If so, is there a way to do this securely?

Answer 1

Well to answer your question if anyone can get data if the rules are set to true: yes, I can query everything from every user when I am registered. Do not do this unless you are testing. Write database rules: only Firebase Database can access every data and check the unique name for you. Simple example:
{
"allusernames": {
".read": false,
".write": "!data.exists() && newData.exists()"
}
}
When you get an error in your code, with other words the write failed, you know the username is taken.