Hello in this awesome 2022, that WILL be better!
here's the case we got and the problem we are facing:
And so in project A:
const firebase = require("firebase-admin");
const botInformURL = "URLTOHIT";
const token = await firebase.auth().createCustomToken("XXX-notification-system");
const output = await axios.post(botInformURL, {
headers: {
"Content-Type": "application/json",
Authorization: "Bearer " + token,
},
method: "post",
body: JSON.stringify({ additionalMessage }),
From the google cloud Platform (for CloudFunctions - in project B setup) I have added service account email ((...)projectA(...)iam.gserviceaccount.com) as a Cloud Functions Invoker (tried admin as well - without success)
And now - I am being blocked on the GCP with a 403.
What I am missing here?
When an unauthenticated caller sends a request to the Cloud Function, they will see a 401/403 status code response. In this scenario, the way out is to ensure that ‘allUsers’ has ‘roles/cloudfunctions.invoker’ role in the Cloud Function's IAM. You may refer to this documentation for more on this.
But yes, you are correct, if you use ‘allUsers’ it would expose the endpoint publicly and anyone would be able to access it.
If you want to avoid this, you have to follow the below steps:
From the receiving function:
1. You need to configure the receiving function to accept requests from
the calling function.
2. Use the gcloud functions add-iam-policy-binding command.
From the calling function:
1. Create a Google-signed OAuth ID token with the audience (aud) set to
the URL of the receiving function.
2. Include the ID token in an
Authorization: Bearer ID_TOKEN header in the request to the
function.
You may also refer to the Stackoverflow link for more information.