Property header for firebase auth token api request to a custom server

I have a project including both a frontend (made with Vue) and a backend (made with Node.js). My server handles all the frontend requests and has its own mongodb. I am using firebase only for the authentications.

My problem is this: how can I make the server sure that a certain request is sent by a logged in user that has the privilege to do that request?

For instance if I have the request POST /user/:uid/products, that makes a user add a product to its account, I want to be sure that it was the actual user that made this request.

I came up with this: https://firebase.google.com/docs/auth/admin/verify-id-tokens#web, getting the user token from the frontend and checking it in the server through the firebase admin api.

I just want to know which is the right header where I should put this token. I mean, should the frontend put the created token in the "Authorization" header? Which header is the most appropriate?

from Recent Questions - Stack Overflow https://ift.tt/3o3znd6
https://ift.tt/eA8V8J