Property header for firebase auth token api request to a custom server

1
votes

I have a project including both a frontend (made with Vue) and a backend (made with Node.js). My server handles all the frontend requests and has its own mongodb. I am using firebase only for the authentications.

My problem is this: how can I make the server sure that a certain request is sent by a logged in user that has the privilege to do that request?

For instance if I have the request POST /user/:uid/products, that makes a user add a product to its account, I want to be sure that it was the actual user that made this request.

I came up with this: https://firebase.google.com/docs/auth/admin/verify-id-tokens#web, getting the user token from the frontend and checking it in the server through the firebase admin api.

I just want to know which is the right header where I should put this token. I mean, should the frontend put the created token in the "Authorization" header? Which header is the most appropriate?

1
resthttpfirebase-authenticationhttp-headers

1 Answers

2
votes

It's customary to put it in the "Authorization" header, just as you said.

Typically the header is formatted like this:

Authorization: Bearer <token>

This is documented in the OAuth 2.0 Authorization Framework: Bearer Token Usage, section 2.1. Your backend should of course parse the same format.