Do Firebase Cloud Functions callable functions enforce end user authentication?

user_9870293 0
Viewed 489

I would like to know if, by itself, callables functions with Firebase Cloud Functions, for example :

exports.myCallableFunction = functions.https.onCall((data, context) => { 
  //... 
});

are safe by themselves or if I need to implement some code inside of them to make sure only authenticated users that calls them gets something out of it. From my understanding, it's called via an API end point, so I'm kind of concerned about everybody being able to call it.

If some logic needs to be implemented, what logic would make sure it's safe?

google-cloud-functions firebase-authentication javascript
2 Answers

If you want only authenticated users to be able to invoke your function, a callable function by itself is not "safe" in that respect. You will need to add code to make sure the user is authenticated, then decide what you want to send if they are not.

exports.myCallableFunction = functions.https.onCall((data, context) => {
    if (!context.auth) {
        throw new functions.https.HttpsError("unauthenticated", "You must be authenticated");
    }

    // continue here if they are auth'd
});
user_8071260

Anyone can call a callable cloud function, but you can easily check whether the user is signed in (and who they are) by checking context.auth.

I recommend reading the documentation on [callable cloud functions], which contains a section on authentication.

user_2091030
Related