Protect Firebase callable functions from man in the middle

Question

I have made my mobile app using firebase on iOS & I use callable functions to communicate with database.

When I try to perform a “man in the middle” attack/move using a simple app as Charles, I can see all my calls with the data I send, in plain text. When I use a well know app like iTunes I cannot decrypt anything (which I think is what we call ssl pinning)

I have 3 questions:

• does firebase cloud functions (https.callable) handle ssl pinning ?
• if not how can I protect from this ? Using node for my function, is it possible to request a ssl certificate from firebase and link it to functions ?
• Does the mobile Sdk request are pinned ? I cannot see anything about read calls on my sniffing app.

Thank you all.

Answer 1

As per this post here by Doug, all data in and out of Google is encrypted (including the client SDKs). There is simply no way around this.

Now, you can take this a step further and prevent abuse by configuring App Check which, according to the documentation, provides an additional layer of security against billing fraud and phishing.

However, you will still need to check the authentication token (automatically passed in with onCall functions) to make sure the user is authorized to execute the functions they are calling.