First things first, make sure Firebase Authentication is turned on in the Firebase Console. Head over to the Authentication section and set up the sign-in methods you plan to use.

In your index.js or functions.js, bring in the Firebase Admin SDK and Firebase Functions SDK.

const functions = require('firebase-functions');
const admin = require('firebase-admin');
admin.initializeApp();

Create a middleware function to check ID tokens from clients. This makes sure the incoming request is legit.

async function authenticate(req, res, next) {
    if (!req.headers.authorization || !req.headers.authorization.startsWith('Bearer ')) {
        res.status(403).send('Unauthorized');
        return;
    }

    const token = req.headers.authorization.split('Bearer ')[1];

    try {
        await admin.auth().verifyIdToken(token);
        next();
    } catch (error) {
        res.status(403).send('Unauthorized');
    }
}

Wrap your HTTP endpoint with the authentication middleware so all requests get authenticated first.

exports.secureEndpoint = functions.https.onRequest((req, res) => {
    authenticate(req, res, () => {
        // Your secure function logic here
        res.status(200).send('Request authenticated and fulfilled');
    });
});

Make sure CORS is set up to control access to your function. If you haven't already, install the cors package via npm:

npm install cors

Then, integrate CORS in your function:

const cors = require('cors')({ origin: true });

exports.secureEndpoint = functions.https.onRequest((req, res) => {
    cors(req, res, () => {
        authenticate(req, res, () => {
            // Your secure function logic here
            res.status(200).send('Request authenticated and fulfilled');
        });
    });
});

If you need more than just authentication, like checking user roles or permissions, do it within your function logic:

async function authorize(req, res, next) {
    const token = req.headers.authorization.split('Bearer ')[1];
    try {
        const decodedToken = await admin.auth().verifyIdToken(token);
        const userId = decodedToken.uid;

        // For example, checking user role or permission:
        const userRecord = await admin.auth().getUser(userId);
        if (userRecord.customClaims && userRecord.customClaims.admin === true) {
            next();
        } else {
            res.status(403).send('Forbidden');
        }
    } catch (error) {
        res.status(403).send('Forbidden');
    }
}

exports.secureEndpoint = functions.https.onRequest((req, res) => {
    cors(req, res, () => {
        authenticate(req, res, () => {
            authorize(req, res, () => {
                // Your secure function logic here
                res.status(200).send('Request authenticated and authorized');
            });
        });
    });
});

Test the secure endpoint with an authenticated request using a tool like Postman or through your front-end app. Make sure the request includes a valid Firebase ID Token in the Authorization header.

GET /secureEndpoint HTTP/1.1
Host: your-cloud-functions-url
Authorization: Bearer YOUR_FIREBASE_ID_TOKEN

All requests without a valid token should get a 403 Unauthorized or Forbidden response based on the error handling.