security - Firebase: Does the auth.uid stay active across page tabs? -

tools: firebase 2.3.1

problem type : setting security rules user in session

authentication method: authwithpassword()

i know user logged app in browser. i set rules expectation once user has opened session can access room data in tab on browser.

yet if try fetching url below in different tab in same browser..

https://myfirebaseurl.firebaseio.com/rooms.json

..i

{   "error" : "permission denied" } 

which weird because url working fine in program in tab open app or if refresh page

for instance isn't throwing errors:

var firebaseroomsref = new firebase("https://myfirebaseurl.firebaseio.com/rooms")//fetch fine 

here rules like:

 {      "rules": {          "rooms": {               ".read": "root.child('users/'+auth.uid).exists()",          }  } 

so main question: error happening because i'm trying call url json directly that? or app doing differently giving permission access messages?

a side question: firebase automatically storing "auth" token or cookie in program when call authwithpassword() right?

yes, error happening because you're trying open url directly. when open url directly in browser, there's no auth data sent unless append auth query parameter.

https://myfirebaseurl.firebaseio.com/rooms.json?auth=credential

when authenticate within app, firebase automatically storing auth token in localstorage only domain hosting app returning user retain session.