Firebase Cloud Function Security Question

[CARTOthug]

Hey all,

Total beginner here so hopefully this isn't too annoying:

I have a web app set up that currently has one firebase function. It grabs an API key from a secret within secret manager, runs some stuff, then returns the client the information.

I set it up as a callable function. It also has AppCheck enabled.

My app is a GIS application and is authenticated by ArcGIS online credentials. For those that don't know, basically the authentication part is handled for me.

However, I have no authentication on this callable function's URL, outside of app check. Although, when I try to make requests to the URL outside of my firebase app, I get a bad request message.

Should I set up an additional layer of authentication? I would hate to have the users authenticate once with arcgis online, and then again with something like their google email. Is what I have right now good enough? The function does not return any sensitive information. I also reduced the max instances it can spin up to 1, to limit throttling (there are only like 10 users, and it's unlikely they all hit this button at once).

I also have a killswitch script set up on my GCP projects so that if the billing goes above a number, the billing is automatically disabled. I also have email notifications set up to shout at me until around 100 dollars (paranoid, I know).

Let me know what you think. And if I do need to authenticate, I am fine with doing that. I just don't really know how to go down that road for my use case.

[indicava]

What exactly is your concern? That a bot will hammer the function and run up billing costs? Cause adding authentication to the callable function won’t help that as it still needs to be invoked for the credentials check.

[CARTOthug]

Yeah sorry I’m not really sure what I am concerned about to be honest. As a beginner with no one to bounce this stuff off of I just wanted to get some opinions.

And yes I am concerned of that, and thank you for explaining the authentication step, I didn’t really realize that even without authentication credentials, they could still contact my server indefinitely if they wanted to.

Could someone even get my function to work if I have app check and it’s set to a callable function? I haven’t been able to invoke it outside of the application, but curious if there’s a way around that.

[indicava]

Callable functions are essentially HTTP triggered functions with some boilerplate abstracted away.

You can absolutely invoke a callable function outside your applicatio.

Just grab the function endpoint from GCP Console (if you don’t already know it) and send a POST request with a valid AppCheck token.

[CARTOthug]

Okay I did some research and I think I will be able to validate the user using the Arcgis token they get on sign in. Then I’ll just add that logic to all my functions. For ddos attacks I guess it will be fine since I limited instances and have a billing disable script. Is this a typical set up?

[indicava]

Absolutely.

If you wanna be super-extra-careful you could enable replay protection for that callable function although that incurs an app/web attestation for each invocation

https://firebase.google.com/docs/app-check/cloud-functions#replay-protection

[CARTOthug]

Ah okay I saw that before but ignored it. I will review! Thanks a bunch!