I think the section of the Firebase docs that you link to answers your question (I've quoted that section below for reference).
I believe this is trying to avoid you putting Insecure Direct Object Reference (IDOR) vulnerabilities into your application. OWASP has a great slide deck about IDOR vulns.
The simple example of IDOR vuln is when you have a URL like this:
and if you change it to
userID=8 then you can see someone else's balance. That's bad.
Basically, never trust the user to tell you who they are; read that from a trusted authentication token. Your firebase docs say pretty much exactly that:
After you receive the ID token by HTTPS POST, you must verify the integrity of the token.
If you're getting the userID from a google-backed auth token, and you're following Google's advice for how to properly validate that token, then you're probably doing right already.
It's probably also worth spending a few minutes convincing yourself that this can't be spoofed, for example: how does the JWT signature work and could an end-user spoof a signature? How are the JWTs transmitted to the client, and how are they stored at the client? How big is the risk that an attacker could get hold of another user's JWT? Etc.
Just for reference, here is the section from the Firebase docs that you link to:
Verify the integrity of the ID token
After you receive the ID token by HTTPS POST, you must verify the integrity of the token. To verify that the token is valid, ensure that the following criteria are satisfied:
The ID token is properly signed by Google. Use Google's public keys (available in JWK or PEM format) to verify the token's signature. These keys are regularly rotated; examine the Cache-Control header in the response to determine when you should retrieve them again.
The value of aud in the ID token is equal to one of your app's client IDs. This check is necessary to prevent ID tokens issued to a malicious app being used to access data about the same user on your app's backend server.
The value of iss in the ID token is equal to accounts.google.com or https://accounts.google.com.
The expiry time (exp) of the ID token has not passed.
If you want to restrict access to only members of your G Suite domain, verify that the ID token has an hd claim that matches your G Suite domain name.
Rather than writing your own code to perform these verification steps, we strongly recommend using a Google API client library for your platform, or a general-purpose JWT library. For development and debugging, you can call our tokeninfo validation endpoint.