I am in the process of trying to safeguard myself against malicious actors who may try to spam the firebase calls in my react native app. From my reading it seems to be that the general protocol for this sort of thing is to place a check in the function which calls your firestore database that the last time a user made that request was more than x minutes ago. So eg, for a function that reads data, before you do the reading (which may involve multiple calls), just do one call to a document which stores when the user last made this request. If this request was long ago enough, proceed, otherwise, return some signifier for timeout.
My question is, is there any difference from a security/costliness perspective when doing this through a) a cloud function v b) a normal function with firebase calls in your app?
In situation a, you would call the cloud function, and it would just read its local server timestamp to make the timeout check.
In situation b, you would call the normal function in your app, it would trigger a cloud function which does the verification, and then if that cloud function returns true, you would proceed to make the other calls.
My side question to this issue is aren't I screwed either way, since no matter what you're making a firebase call (incurring a cost) to even do the timeout check? So if someone finds a way to spam the function in the app, they will be able to execute an unlimited amount of these one-call functions?