有没有办法验证从非谷歌应用程序到谷歌云功能的 http 请求？

Question

When I read Google Cloud Functions' documentation on authentication, it seems the available authentication methods can only be used to authenticate a Google user or another Google Service (Service Account).

Well, I have a use case where I want to authenticate webhooks that come from apps like Monday.com and Clockify. I want events in those apps to trigger my Cloud Function and I want this to be secure and possibly even GDPR compliant. Is there any reliable way to authenticate requests received from those apps? Have I missed something in Google's documentation, products, and features or is there actually no way for this to be done?

Answer 1

If those services support computation, such as signing data and calling endpoints then possibly. I am not aware of their interfaces or features. Most services do not provide computation as part of a webhook.

Google uses OAuth Identity Tokens for service authentication. This requires creating a JWT, signing it with an RSA private key, etc.

For interfaces that cannot meet the requirements of generating an identity token, I often use a simple secret value (a large random 128-bit number) and pass that secret as a custom HTTP header value. Inside my Function application, I check the header for the correct secret. If there is no match, drop the connection or return an error. If valid continue processing.

The best solution is to use Google Identity-based authorization but that is not always possible with some services.

Answer 2

The solution of John is one possible solution, that we used a lot in my previous company.

However, you have also another solution, based on API key. I wrote and article on that. It's pretty old and you can now use API Gateway (which is a managed solution of ESPv2) but the principle and the APISpec code are the same

Keep in mind that, in term of security, it's still a long lived token, as John solution, and it's not better. You simply have additional feature, like rate limiting (another article)