如何阻止未经身份验证的用户使用我的 Cloud Functions？

Question

My approach to block unauthenticated user to use my Firebase Cloud Functions is to add this boilerplate code in the beginning of all functions. Please note that I am using Callable Function functions.https.onCall , NOT HTTP Function functions.https.onRequest

if (!context.auth) {
    // Throwing an HttpsError so that the client gets the error details.
    throw new functions.https.HttpsError(
      "failed-precondition",
      "The function must be called while authenticated."
    );
  }

Is there a better way to block unauthenticated user so that invalid call can NOT even invoke my function?

Answer 1

If you are using Firebase Authentication and also use custom claims, using context auth might be easiest way to do check that. Alternatively, you can allow only allAuthenticatedUsers to invoke the Cloud Function as shown below:

However, in this case you'll have to add and verify that Authorization header manually. You can use gcloud auth print-identity-token to get your token (different that Firebase Auth's ID token) for testing.