I'm having an issue setting my Security rules properly, specifically reading the post data.

The data hierarchy goes:

posts : {
    0 : {
        title: "Post One",
        userId: 6
    }
},
users : {
    6 : {
        name: "My Name"
    }
}

And my rules are:

{
  "rules": {
    "posts" : {
      "$post": {
         ".read":"data.child('userId').val() == auth.id",
         ".write":"newData.child('userId').val() == auth.id"
      }
    },
    "users":{
      "$user": {
        ".read":"auth.id == $user",
        ".write":"auth.id == $user"
      }
    }
  }
}

I know that the "auth.id" is 6, because it's pulling the rules correctly for my user info. If I change the rules to pull the number statically, it works:

      "$post": {
         ".read":"data.child('userId').val() == 6",
         ".write":"newData.child('userId').val() == auth.id"
      }

but using auth.id does not. Is there something I'm missing?

One thing to keep in mind is that security rules are type-safe. In particular, In the rules, "6" != 6 (since one is a string and one is a number). So perhaps your auth.id is "6" (as a string), but your userId is 6 as a number?

If that's the case, one potential fix would be changing your rule expression to something like:

data.child('userId').val() + '' == auth.id

which will force userId to be a string. Alternatively, you could change your data to make sure userId is always stored as a string.