backend.js

// do this before your work needs an authentication
if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
  console.log('Found "Authorization" header');
  // Read the ID Token from the Authorization header.
  idToken = req.headers.authorization.split('Bearer ')[1]
  const decodedIdToken = await admin.auth().verifyIdToken(idToken)
  console.log('ID Token correctly decoded', decodedIdToken)
  req.user = decodedIdToken
}else{
  // If this called without correct authentication, it will return 401 response.
  console.log(req.auth)
  res.status(401).send({error: `You don't have a permission to request.`})
}