This samples shows how to restrict an HTTPS Function to only the Firebase users of your app.

Only users who pass a valid Firebase ID token as a Bearer token in the Authorization header of the HTTP request or in a __session cookie are authorized to use the function.

Checking the ID token is done with an ExpressJs middleware that also passes the decoded ID token in the Express request object.

Once authorized the function respond with 'Hello '.

This sample comes with a simple web-based UI which code is in public directory that lets you sign-in Firebase and initiates an authorized XHR to the Function.

1. Create a Firebase Project using the Firebase Console .
2. Enable the Google Provider in the Auth section.
3. Clone or download this repo and open the authorized-https-endpoint directory.
4. You must have the Firebase CLI installed. If you don't have it install it with npm install -g firebase-tools and then configure it with firebase login .
5. Configure the CLI locally by using firebase use --add and select your project in the list.
6. Install dependencies locally by running: cd functions; npm install; cd -

This sample comes with a web-based UI for testing the function. To test locally do:

1. Start serving your project locally using firebase serve --only hosting,functions
2. Open the app in a browser at http://localhost:5000 .
3. Sign in the web app in the browser using Google Sign-In and two authenticated requests will be performed from the client and the result will be displayed on the page, normally "Hello ".

To deploy and test on prod do:

1. Deploy your project using firebase deploy
2. Open the app using firebase open hosting:site , this will open a browser.
3. Sign in the web app in the browser using Google Sign-In and two authenticated requests will be performed from the client and the result will be displayed on the page, normally "Hello ".

We'd love that you contribute to the project. Before doing so please read our Contributor guide .

ⓒ Google, 2017. Licensed under an Apache-2 license.