Firebase Auth + Python后端

Question

I am going to use Firebase Auth and Database modules to create my web app. However, not all things that I want my app to do is possible to achieve on only front end. So I want to also use backend with Python's Bottle framework to handle requests and Pyrebase to get access to Firebase Database.
Let's say that after logging in I need to go to mainpage and see personalized content, for example my notes. They are structured this way in DB:

{
    "notes": [{
        "id": "1",
        "title": "X",
        "author": "user1"
    },
    {
        "id": "2",
        "title": "Y",
        "author": "user2"
    } and so on... ]
}

So how it's possible to implement showing only my articles on main page? I understand that I need to filter my notes based on author value, but how to let Bottle understand who is currently logged in?
I've read there , that I should somehow send unique token to backend server to authenticate current user, but how to do that? Inserting Token in every link as GET parameter seems to be silly, but I see no other way to implement that.

Answer 1

Start by organizing your database so that each note becomes a child object:

{
  "notes": {
    "id1": {
      "id": "id1",
      "title": "X",
      "author": "user1",
    },
    "id2": {

    }
  }
}

Then this particular interaction can be implemented entirely in the client-side. Just execute a query to filter the notes you want. For example in a JS client:

var uid = firebase.auth().currentUser.uid;
var query = ref.orderByChild('author').equalTo(uid);
// Listen for query value events

If you want to run this on a backend server, and you want to ensure that only logged in users are allowed to execute it, then you must pass the ID token from the client app to the server on each request. Here's how to implement the server-side logic using the Python Admin SDK:

import firebase_admin
from firebase_admin import auth
from firebase_admin import db

token = '....' # Extract from the client request
try:
    decoded = auth.verify_id_token(token)
    uid = decoded.uid
    ref = db.reference('path/to/notes')
    notes = ref.order_by_child('author').equal_to(uid).get()
    # Process notes response
except ValueError as ex:
    print(ex)
    # Send error to client