Authenticate users via Cloud Functions

Question

I'm trying to construct a RESTful API using firebase and cloudfunctions to dont depend on firebase client API. The ADMIN SDK provided by firebase greatly extends the user management capabilites, but I can't find anywhere a way to authenticate users via a REST call.

So, what are my possibilities? Is there a way to do this using firebase auth system or I would have to create a separate one and auth my users with custom jwt tokens?

Answer 1

If you deploy your function in private mode (I mean only authenticated and authorized user can call it. For this, you need a google signed identity token. I don't know what is possible to do with Firebase, but most of time, it's not possible.

The solution is to use Cloud Endpoint in front of your Cloud Functions. Cloud Endpoint support Firebase auth authentication, and Cloud Endpoint can host a compliant OAuth2 identity (named service account on GCP).

I wrote an article to secure serverless product with API Keys. You simpy have to change the security definition into firebase auth, and it should work.

Answer 2

I'm not 100% sure to understand your goal, but here are some food for thought:

1. In a Cloud Function for Firebase you use the Admin SDK to interact with Firebase services (i.e. fetching Firestore or generation of the signed URL of a file stored in Cloud Storage, etc.). With the Admin SDK you actually completely bypass the security rules of the different Firebase services.
2. If your Cloud Function for Firebase is called directly by an authenticated user and you want, in the Cloud Function, to identify the user who is calling it, there are two cases: (a) It is a Callable Cloud Function: the user information is automatically added to the request, see the doc. (b) It is a "simple" HTTP Cloud Function: you will find here a sample which shows how to restrict it to only the Firebase users declared in the Firebase Auth service. Then, when you know who is the user, you will have to implement the access control yourself, because, as said above, with the Admin SDK you have full access to all the services.
3. If your goal is to authenticate users via a REST API call (independently of Cloud Functions), you can use the Firebase Auth REST API with the Firebase Auth service. In particular you can call the following endpoint: https://firebase.google.com/docs/reference/rest/auth#section-sign-in-email-password. The response contains an idToken that you can use to call an HTTP Cloud Function which implements the restriction described in point 2b above (just call the Cloud Function endpoint with the following HTTP request header: 'Authorization': 'Bearer ' + idToken).