Authenticate https-triggered cloud functions

Question

I'd like to have some cloud functions in firebase which are only triggerable by authenticated users, like

exports.samplefunc = functions.https.onRequest((req, res) => {
    return db.collection('tests').add({
        user: req.body.id
    })
    .then(result => response.status(200).send())
    .catch(err => response.status(401).send());
});

How would I call this function from my client, if possible in Swift or ObjC :)

Answer 1

You may include a bearer token in the https request header.

The logic is: 1) your signed in user gets a token with firebase.auth().currentUser.getToken() that is sent in the request header. Then in the cloud function, after extracting the token, you can verify it with admin.auth().verifyIdToken(idToken) using the admin sdk.

See this example repo from firebase or this GCP example for more info.