问我是否安全地使用Firebase IDToken验证数据？

EN

   const getUserById = (request, response) => { //Dammi l'utente con il tokenID passato
    const idToken = request.params.idToken
    utils.firebase.auth().verifyIdToken(idToken)
      .then(function(decodedToken){
        let uid = decodedToken.uid

        utils.pool.query('SELECT * FROM users WHERE uid = $1', [uid], (error, results) => {
          if (error) {
            throw error
          }
          response.status(200).json(results.rows)
        })
      }).catch(function(error) {
        // Handle error
      });
  }



const createUser = (request, response) => { //Crea nuovo user
    const { idToken, fullname} = request.body

      utils.firebase.auth().verifyIdToken(idToken) //Verifico il token utente in ingresso
        .then(function(decodedToken) { //se è verificato allora estraggo l'uid
          let uid = decodedToken.uid;
          console.log("Registered new User, UID: " + uid)
          console.log("name: " + fullname)
          utils.pool.query('INSERT INTO users (uid,fullname) VALUES ($1, $2)', [uid, fullname], (error, results) => {
            if (error) {
              throw error
            }
            response.status(201).send(`User added with ID: ${results}`)
          })
        }).catch(function(error) {
          // Handle error
        });
  }


  const updateUser = (request, response) => { //Aggiorna le info dell'utente, nome e biografia, l'email verrà gestita da firebase
    const idToken = request.params.idToken
    const { fullname, bio } = request.body

    utils.firebase.auth().verifyIdToken(idToken) //verifico che il token sia vero
    .then(function(decodedToken){
      let uid = decodedToken.uid //estrapolo lo uid dell'utente
      console.log("Edited the user: " + uid)
      console.log("Name: " + fullname)


      utils.pool.query(
        'UPDATE users SET fullname = $1, bio = $2 WHERE uid = $3', [fullname, bio, uid], (error, results) => {
          if (error) {
            throw error
          }
          response.status(200).send(`User modified with ID: ${results}`)
        }
      )
    })
  }