Can I secure my cloud function using Firebase Auth, but without using callable cloud functions. (HTTP request only) [duplicate]

Question

In my project I use a bunch of GCP services, including Firestore, Cloud Functions and Firebase auth.

Taking the fact that users are able to login via Firebase auth service, I assume that it should be possible to check and authenticate users calling my cloud function. Issue is that I can not find any docs or example of how to do that.

I understand that there are special callable functions but it doesn't suit me. I am using express for handling requests.

Is it possible to retrieve some kind of JWT token from user logged in on client side (firebase auth) then send it with request to my cloud function and then check it somehow there? Or is there any other mechanism to achieve CF protection described above?

P.S. I saw this question, but it is not about what I am asking, because it is related to Firebase Functions and I am talking about Cloud Functions which is very similar but not exact same thing.

Answer 1

So, according to Dougs suggestion and after some additional googling I found out the way which should work for me.

On client side we need to retrieve id token of authenticated user:

const token = await firebase.auth().currentUser.getIdToken(true);

Now we can actually add this token to any request we need. I am going to put in request headers while calling my HTTP triggered cloud function. For example:

...
const headers = {
    'Authorization': token
}
const response = await fetch('CF_URL', {headers});
....

The last and most important thing here is to have verification logic on the serverside (Cloud functions in my case):

try {
    const userData = await admin.auth().verifyIdToken(tokenFromHeaders);
    console.log(userData.uid) // here we have uid of verified user
    // check user access or do whatever we need here
} catch (e) {
    // something go wrong
}