I have a Firebase project with a mobile app (Flutter) that uses callable Cloud Functions. From the app, I invoke them with the Firebase SDK like this:
const functions = firebase.functions();
const callable = functions.httpsCallable('myFunctionName');
callable({ someData: 'value' }).then(result => {
console.log(result.data);
});
I assumed that onCall functions could only be invoked by my app’s authenticated clients. However, I discovered I can call the underlying HTTPS endpoint directly from a browser or Postman using the URL. It still executes—even when not called from my app.
In my Python Cloud Function, I’ve already added this authentication check:
if not req.auth or not req.auth.uid:
return {"status": 400, "message": "User not authenticated"}
Because of this check, an unauthenticated caller can’t run the actual function logic. However, the request still causes the function instance to spin up (cold start), meaning it consumes resources and could be abused for a DoS-style cost attack.
I’ve also enabled App Check, so legitimate app clients must pass verification — but the HTTPS endpoint still remains publicly reachable.
Config observation: In Google Cloud Console → Cloud Functions → Permissions, I see:
Authentication: Require authentication
Warning: This service is publicly accessible because 'allUsers' has been granted permission on the service.
Does this IAM setting explain why the endpoint is still publicly accessible? If I remove allUsers from the IAM policy, will it block all external requests before they spin up the function, so only authenticated users from my app can call it?
An onCall request includes a Firebase Authentication user ID token for the logged-in user making the request. The backend automatically verifies this token and provides it in the handler's context. If the token is invalid, the request is rejected. However, I find it odd that my billable container instance count still reaches 1.
Did see a similar question here : but does not have a solution : How do you make a HTTPS onCall Cloud Function deployed via Firebase private
