Why authorization validation for Firebase onCall is inefficient?

Xavier D 0
Viewed 22

According to the Firebase documentation about onCall 'callable' functions :

The functions.https.onCall trigger automatically deserializes the request body and validates auth tokens.

Also, according to the Firebase callable Functions protocol specification:

If the auth token supplied in the request is invalid, the request is rejected with 401 Unauthorized, with an error code of UNAUTHENTICATED.

However, I experimented that it's possible to call a function with invalid Authorization header like Authorization: fooBar or worst, without providing it:

curl -X POST --location https://my-test-app.cloudfunctions.net/hello -d "{data:{})"

The function responds "Hello world!" as expected (http 200 'ok').
Of course, context.auth is undefined in that case, but still, it's considered as valid.

This is very misleading and dangerous as developers can think their functions are protected by default, but they aren't : anyone can call it publicly.

I know about the default "AllUser" access credential on the firebase deployed function, nevertheless the documentation is confusing.

Did I missed anything to enable or configure to activate a concrete out-of-the-box token validation?

google-cloud-functions firebase-authentication security firebase
1 Answers

A missing auth token is never an error for a callable function. All callable functions are considered publicly accessible.

If you don't want the function to do its work unless a valid auth token is presented in the request, then you should simply write a few lines of code to check that and bail early. The code for that is actually provided in the page of documentation that you linked.

// Checking that the user is authenticated.
if (!context.auth) {
  // Throwing an HttpsError so that the client gets the error details.
  throw new functions.https.HttpsError('failed-precondition', 'The function must be called ' +
      'while authenticated.');
}

If you feel that some functionality is not working as described in the documentation, file a bug report on GitHub with your steps to reproduce the problem.

Doug Stevenson0
Related