Firebase Cloud Functions Http请求-验证用户

Question

I'm building a web app where I want to call a cloud function from the client to edit a part of the database that shouldn't be accessible to the user.

The user should only be able to edit the hidden part of the database that is theirs.

I want to use an HTTP request trigger (as it seems the most practical), but I need to be able to have the client somehow prove through either a parameter or some other method that they are a certain user.

Is this possible, if so what is the best way to do this?

Answer 1

callable functions . Note that firebase.auth() provides user/client authentication. So, the Firebase Functions will be talking to the data store via a service account.

Callable functions are similar to other HTTP functions, with these additional features:

• With callables, Firebase Authentication and FCM tokens, when available, are automatically included in requests.
• The functions.https.onCall trigger automatically deserializes the request body and validates auth tokens.