Securing google firebase cloud function with stripe integration

Question

We are using google cloud platform to host our stripe payment gateway. The cloud function sends the payment intent to stripe and a callback that stripe calls with a session object.

Inside the google cloud platform, we are not sure what permission to set our cloud function. Right now, we allow all public access and we are fearing that a hacker can see our secret key from our index.js (where the cloud functions live), or has the ability to manipulated the code inside of the index.js.

With the function's purpose described above, what is the safest permission setting that does not allow any public users to read or manipulate our functions? All we want is to allow the users to invoke the function,

thank you

Solution 1

check how these guys implement their stripe functions, they have a bunch of them https://functions.store

Solution 2

I've implemented Stripe for an app using a combination of the Golang SDK and JavaScript SDKs that I'm deploying as an app to Cloud Run. So my config is slightly different to yours.

You should be able to:

1. Provide some protection by keeping Stripe's API keys as environment variables so that the JavsScript only accesses these in-memory. You may want to consider using Secret Manager.
2. Differentiate between authenticated handlers that trigger the flow and restricted handlers that accept the callback from Stripe.
3. You can authenticate using Cloud IAP (Google auth requiring users be part of the project) or e.g. Cloud Endpoints and Firebase auth
4. You can restrict access to the callback to Stripe's endpoints

I'm not a security guy.

Your learnings would make an interesting customer story for Stripe and GCP.