authenticate.js

/* 
    This middleware accesses the firebase id token in the request header.
    Then we use the Firebase Admin SDK to verify the token. 
    If successful we pass the route on, otherwise we return an error
*/
const admin = require("firebase-admin");
const serviceAccount = require("../config/firebase-account.json");

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: "https://YOUR_URL.firebaseio.com"
});

exports.requireAuth = async (req, res, next) => {
  const idToken = req.header("FIREBASE-AUTH-TOKEN");
  let decodedIdToken;
  try {
    decodedIdToken = await admin.auth().verifyIdToken(idToken);
  } catch (error) {
    next(error);
    return;
  }
  req.user = decodedIdToken;
  next();
};