javascriptfirebasegoogle-cloud-firestoregoogle-cloud-functions

Is it secure to send the user UID to firebase cloud functions

I have a firestore collection and every user has one document. The document name is equal to the user UID.

I write to these documents with a firebase function. So I pass the user UID to this firebase cloud function so the function can write to the database (this is just a very simple write so I won't show it here).

Here is the function call in my js file:

const saveAllTimeData = firebase.functions().httpsCallable('saveAllTimeData');
saveAllTimeData({ data: firebase.auth().currentUser.uid })

But I am not very sure if this is safe.

Can't just someone change the firebase.auth().currentUser.uid part before the execution? And f.e. put in another uid to change documents he shouldn't be able to change?

Solution

  • The user's UID is safe to share as a UID acts like a fingerprint to differentiate and identify a user from another. these do not in any way give permission or power over that user, it is simply a random set of characters that is unique.

    With the Admin SDK, you are also able to create these UID's per design, allowing you to have a custom UID that may represent their username if so desired.

    Since you are also using a httpsCallable cloud function, this includes a value called context, which uses the JWT token from the auth module. the JWT token is decodable to the user and should not be shared. however, the method httpsCallable secures it through the HTTPS tunnel making it secure from most hijacking.

    in your function, you should notice the context variable

    exports.addMessage = functions.https.onCall((data, context) => {
  // ...
});

    For onCall, context contains a property called auth of which contains the decoded JWT values

    // Message text passed from the client.
const text = data.text;
// Authentication / user information is automatically added to the request.
const uid = context.auth.uid;
const name = context.auth.token.name || null;
const picture = context.auth.token.picture || null;
const email = context.auth.token.email || null;

    references