如何保护支持自建服务器调用的HTTP云函数的安全性？

Great question! When you're calling Firebase Cloud Function HTTP endpoints from your own self-hosted server (with custom token auth already set up), there are several solid, production-ready ways to keep those calls secure. Let’s walk through the most reliable approaches:

1. Generate ID Tokens via Firebase Admin SDK (Service Account) #

This is the most straightforward method if you’re already embedded in the Firebase ecosystem. Here’s how to implement it:

• First, download your Firebase project’s service account JSON file from the Firebase Console (under Project Settings > Service Accounts). Store this securely on your self-hosted server—never hardcode it; use environment variables or a secrets manager instead.
• Use the Firebase Admin SDK on your server to generate a custom token, then exchange it for a valid ID token (since custom tokens can’t be directly verified in cloud functions). For example, in Node.js:

  const admin = require('firebase-admin');
  admin.initializeApp({
    credential: admin.credential.cert(JSON.parse(process.env.SERVICE_ACCOUNT_KEY))
  });
  
  async function generateServerIdToken() {
    // Use a fixed UID to represent your server (or create a dedicated Firebase Auth user for this purpose)
    const serverUid = 'self-hosted-server-123';
    // Add custom claims to explicitly identify this as a server-originated request
    const customClaims = { isTrustedServer: true };
    
    // Create a custom token
    const customToken = await admin.auth().createCustomToken(serverUid, customClaims);
    
    // Exchange the custom token for an ID token via Firebase Auth's sign-in endpoint
    // (You can use a simple POST request here with your Firebase API key)
    const signInResponse = await fetch(
      `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${process.env.FIREBASE_API_KEY}`,
      {
        method: 'POST',
        body: JSON.stringify({ token: customToken, returnSecureToken: true })
      }
    );
    const signInData = await signInResponse.json();
    return signInData.idToken; // This is the valid ID token to send to your cloud function
  }
  

• In your Firebase Cloud Function, verify the ID token and check for the custom claim to ensure it’s a legitimate server call:

  const admin = require('firebase-admin');
  admin.initializeApp();
  
  exports.securedEndpoint = functions.https.onRequest(async (req, res) => {
    const idToken = req.headers.authorization?.split('Bearer ')[1];
    if (!idToken) {
      return res.status(401).send('Unauthorized: No token provided');
    }
  
    try {
      const decodedToken = await admin.auth().verifyIdToken(idToken);
      // Validate the custom claim to confirm it's your server
      if (!decodedToken.isTrustedServer) {
        return res.status(403).send('Forbidden: Not a trusted server request');
      }
      // Proceed with your function logic
      res.status(200).send('Request processed successfully');
    } catch (error) {
      res.status(401).send('Unauthorized: Invalid token');
    }
  });
  

2. Use OAuth2 Access Tokens for Server-to-Server Calls #

If you prefer a more standard server-to-server auth flow, you can generate an OAuth2 access token using your service account:

• Use the Google Auth Library to generate an access token scoped to your Firebase project. For Node.js:

  const { GoogleAuth } = require('google-auth-library');
  const auth = new GoogleAuth({
    keyFile: process.env.SERVICE_ACCOUNT_KEY_PATH,
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  });
  
  async function getServerAccessToken() {
    const client = await auth.getClient();
    const accessToken = await client.getAccessToken();
    return accessToken.token;
  }
  

• In your cloud function, verify the access token and confirm it’s issued to your service account:

  exports.securedEndpoint = functions.https.onRequest(async (req, res) => {
    const accessToken = req.headers.authorization?.split('Bearer ')[1];
    if (!accessToken) {
      return res.status(401).send('Unauthorized: No token provided');
    }
  
    try {
      // Validate the access token via Google's token info service
      const tokenValidationResponse = await fetch(
        `https://oauth2.googleapis.com/tokeninfo?access_token=${accessToken}`
      );
      const tokenInfo = await tokenValidationResponse.json();
      
      // Check that the token belongs to your service account
      if (tokenInfo.email !== 'your-service-account@your-project.iam.gserviceaccount.com') {
        return res.status(403).send('Forbidden: Unauthorized service account');
      }
      // Proceed with your function logic
      res.status(200).send('Request processed successfully');
    } catch (error) {
      res.status(401).send('Unauthorized: Invalid token');
    }
  });
  

3. Custom API Key + Request Signing (Alternative) #

If you want to avoid Firebase’s token system entirely, implement a custom auth flow with API keys and signature verification:

• Generate a strong, unique API key and store it securely on both your server and in your cloud function’s environment variables.
• When making a request from your server, generate a signature (using HMAC-SHA256) of the request body + a timestamp, then include the API key, timestamp, and signature in request headers. Example in Node.js:

  const crypto = require('crypto');
  const API_KEY = process.env.SECURE_API_KEY;
  
  function generateRequestSignature(body) {
    const timestamp = Date.now().toString();
    const payload = `${timestamp}:${JSON.stringify(body)}`;
    const signature = crypto.createHmac('sha256', API_KEY).update(payload).digest('hex');
    return { timestamp, signature };
  }
  

• In your cloud function, verify the API key, timestamp (to prevent replay attacks), and signature:

  const crypto = require('crypto');
  
  exports.securedEndpoint = functions.https.onRequest(async (req, res) => {
    const apiKey = req.headers['x-api-key'];
    const timestamp = req.headers['x-request-timestamp'];
    const signature = req.headers['x-request-signature'];
  
    if (!apiKey || !timestamp || !signature) {
      return res.status(401).send('Unauthorized: Missing auth headers');
    }
  
    // Validate API key
    if (apiKey !== process.env.SECURE_API_KEY) {
      return res.status(403).send('Forbidden: Invalid API key');
    }
  
    // Reject expired requests (e.g., older than 5 minutes)
    const now = Date.now();
    if (now - parseInt(timestamp) > 5 * 60 * 1000) {
      return res.status(401).send('Unauthorized: Request expired');
    }
  
    // Recompute signature and verify match
    const computedSignature = crypto.createHmac('sha256', process.env.SECURE_API_KEY)
      .update(`${timestamp}:${JSON.stringify(req.body)}`)
      .digest('hex');
    
    if (computedSignature !== signature) {
      return res.status(403).send('Forbidden: Invalid signature');
    }
  
    // Proceed with your function logic
    res.status(200).send('Request processed successfully');
  });
  

Best Practices #

• Rotate Secrets Regularly: Whether using service account keys or custom API keys, rotate them periodically to reduce compromise risk.
• Short-Lived Tokens: For ID tokens and OAuth2 access tokens, use short expiration times (e.g., 1 hour) to limit damage if a token leaks.
• Minimize Permissions: Give your service account only the minimal permissions it needs (avoid full Firebase Admin access unless required).
• Validate Inputs: Even with auth, always sanitize and validate incoming requests to prevent injection attacks.

内容的提问来源于stack exchange，提问作者aloj