Accessing user data in firestore using Cloud Functions, but how do I securely send the UID/IDToken?

Question

I am trying to send a http request with user's uid or token securely to my cloud functions to validate some data before posting/updating it through cloud functions.

Do I just send the token/uid in string format? I googled it and for web development that use Bearer auth (super confused now). I am wondering what to do in swift? Is it ok to send the token/uid in string format or is there a more robust way?

Answer 1

Just send the token exactly as you get it from the Firebase Auth API - as a string. You then take that same string and pass it directly to the Admin SDK to verify it as you see in the documentation . There's no need to add any additional security if your access to Cloud Functions is over HTTPS, which it should be.