CODEWITHSUNDEEP
firebasegoogle-cloud-functionsfirebase-hosting
Spiral Out
Spiral Out

Reputation: 1155

Protect Firebase functions without auth

Is it possible to protect firebase http triggered functions without auth and accept calls only from my firebase hosted app?

I want my web app to call firebase functions with unauthenticated users but I don't want this functions to be accessible from anywhere else.

Upvotes: 1

Views: 745

Answers (1)

Doug Stevenson
Doug Stevenson

Reputation: 317467

This is not possible to enforce. All of your HTTP functions are accessible by all other clients out there, regardless of where they are in the world (unless something in their network is blocking them).

You could certainly make an attempt to guess if a request did not originate from your web site (by looking at the referrer header), but that information can be easily spoofed by an attacker.

Upvotes: 2

Related Questions