Right now i have a function in Google cloud that is receiving/processing the requests, but since its open anyone with the URL to the function could potentially write data to the database. While the function URL is private and only used by Notehub i’d like to at least secure it a little bit.
My first thought is changing the route to be a generic https route and adding CORS headers myself so that in Google Functions i can make sure the request is actually coming from Notehub before running the function.
This requires generating a bearer token and adding it as a Header. Unfortunately, this isn’t supported by our current Google Cloud route. As you suggest, you’d have to do it using a Web Request route.
I’ll be adding a feature request to support bearer tokens for Google Cloud routes.
It doesn’t seem to me that CORS is the right approach here, but please enlighten me if you think that’s a better option.
Ah that makes sense and i think is a good approach.
Yeah seems like a no brainer to have some form of auth supported out of the box, without it it makes using routes in a production environment difficult.
The other option i was looking at was making API calls to grab the events, but the routing just works so easily/cleanly I prefer it.