title: Firebase Rules to Allow Server to Write
body: <p>After a user registers, we create a <code>username</code> for the user under <code>/users</code> child.</p>
  <p>How can I setup my rules so that only the server can create new users and user data cannot be modified by other users.</p>
  <h3>Javascript</h3>
  <pre><code>&lt;script&gt;
    var ref = new Firebase(&quot;https://myapp.firebaseio.com&quot;);
    var usersRef = ref.child('users');
  
    var usernameField = $('#usernameInput');
    var emailField = $('#emailInput');
    var passField = $('#passInput');
    $('#submitBtn').click(function() {
      ref.createUser({
        email    : emailField.val(),
        password : passField.val()
      }, function(error, userData) {
        if (error) {
          console.log(&quot;Error creating user:&quot;, error);
        } else {
          console.log(&quot;Successfully created user account with uid:&quot;, userData.uid);
          usersRef.push({
              uid: userData.uid,
              username: usernameField.val()
          });
        }
      });
    });
  
  &lt;/script&gt;
  </code></pre>
  <p>Current rules:</p>
  <pre><code>{
    &quot;rules&quot;: {
      &quot;users&quot;: {
        &quot;.indexOn&quot;: &quot;username&quot;,
        &quot;$uid&quot;: {
          &quot;.write&quot;: true,
  
          // grants read access to any user who is logged in with an email and password
          &quot;.read&quot;: &quot;auth !== null &amp;&amp; auth.provider === 'password'&quot;
        }
      }
    }
  }
  </code></pre>