How to secure firebase https function?

Question

I have a firebase https function:

exports.updateDatabase = functions.https.onRequest((req, res) => {
  // ...
});

Which can be called via: h

Answer 1

You can't stop the function from being invoked by anyone who knows the URL.

You can stop the function from doing something harmful by only allowing it to perform its intended action by requiring that an authenticated user call it, assuming you trust that user.

There is an example of requiring authentication in the official code samples here.