Is it possible to only accept function calls from my app in Firebase?

Question

I am creating a game in Unity where the user can contribute with levels using a Level Creator system.

My application is setup in a way that I just need to call the Cloud Function with the level info, and it handles duplicate entries and saves it to Firestore. All of this works perfectly.

My question, basically, is: can I have my functions only accept calls from my game? (without having my users registered?).

Naturally, I am using functions.https.onCall((data, context) => {}). In the documentation for Firebase, I noticed they use context.auth to check whether the user is authenticated or not. However, I am logging this value to the console and it appears to be undefined.

I am also confused with this line, from the same link:

With callables, Firebase Authentication and FCM tokens, when available, are automatically included in requests.

Maybe context.auth is not defined because my game isn't yet in Google Play / Apple Store? Any ideas?

Answer 1

Thanks to the new feature called Firebase App Check, it is now actually possible to limit calls to Callable Cloud Functions to only those coming from iOS, Android and Web apps that are registered in your Firebase project.

You'll typically want to combine this with the user authentication based security that Doug describes in his answer, so that you have another shield against abusive users that do use your app.