How to activate App Check in android @react-native-firebase/app-check

[AmalRichwin-AT]

I went through the documentation of app-check, but i can't able to understand how to activate the app-check in android. Where should we call the activate method in the app.js or in the navigation file. Please can anyone help me in that.

[mikehardy]

Hi there! Have you looked at how we do it? Examining the "test" aspects of the implementing PR:

99cd4e5

Or at the test app itself is instructive

https://github.com/invertase/react-native-firebase/blob/master/packages/app-check/e2e/appcheck.e2e.js

In short, for android you may activate any time, but it obliterates any other existing providers.
For iOS you must have the Provider you want set up before [FIRApp configure] is called (which is a little tough, yes

It is difficult to set up DebugProviders currently, unfortunately - you may track that here firebase/firebase-ios-sdk#8584 and there's a linked comment from FlutterFire there that indexes right back here with deep links to the strategies we use - I won't repeat them but they might be very useful so I mention

[Strapazzon]

@mikehardy
I have a similar issue.
I don't see a sample in the documentation for activate method. I don't know if I should pass parameters to the activity method on android or not. I see the siteKeyOrProvider is mandatory param, but I don't know to create a new SafetyNetProviderFactory to send this parameter to be activated with SafetyNetProviderFactory.

For example:

  export const appCheckActivate = () => {
    if (isIOS()) {
      return
    }
   return firebase.appCheck().activate('????', true) // What create this first parameter? 
  }

[mikehardy]

You may put whatever you like there
99cd4e5#diff-406415e4817a8b2d1b8cd632fffc7af195be1fe7ec0a560fd0a47df5d7b03ddaR41

It is documented as ignored but the param listing is not coming through in the document render, I'll look into that
99cd4e5#diff-a5c090a3ae8384c83f776f7c58b953c2c88c4f43822b7934bf94db191091bc08R129

[Agusfn]

Hello there, I too am trying to activate AppCheck in our app. So far, we've followed the first config steps described in firebase documentation (for both iOS and Android), managed to activate appCheck, and then tried to get the token but failed with App attestation failed. This is the code:

	firebase.appCheck().activate("ignored_param", true).then(() => {
		firebase.appCheck().getToken().then((token) => {
			console.log("token: ", token.token)
		}).catch(error => {
			console.log("token error", error)
		})
	})

The error I'm getting if I try to get the token is:
[appCheck/token-error] com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.]

I ran the app in Android emulator, with both the debug and production build and threw the error. Is it because I need the app the be installed from the app store in a real device?
Anyway, according to the RNFirebase docs (which is not the most explicative) using debug, AppCheck should be automatically using the Debug Provider, right? If so, should I be getting a debug key in console when making a request with firebase? At least according to the Debug Provider AppCheck docs.

Thanks!

[mikehardy]

The real device will be the only way to pass attestation with the non-debug provider, yes
For the debug provider, my first comment above is still definitive, there's no better way than this rough sketch:

99cd4e5#diff-c77ac52b71991a680aa39c13d3d6d51f28f96d55214fcf9655af02248e49451cR93

which concretely means

99cd4e5#diff-228d8a7764564eacd77e4975dad044b627f8d2916d1c29da9d8f6d53a9c8b8a6R145

and then something like this to push the shared secret in
99cd4e5#diff-0d790b52746c30269e538acf8f2f503329f1da28e00dc90e18cc478eea56f45fR33-R54

on iOS I was able to do it on the command line, but with a fancy variable name that Detox passes through

99cd4e5#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R37

The docs aren't better because the process is kind of awful - it's so low-level and patching it in so forcefully that at that point there are lots of ways to do it, why document this one way, or at least more than our functioning code which is available for all to see and use

You may follow along here, perhaps the SDKs will improve the situation - firebase/firebase-ios-sdk#8584

[Agusfn]

Thank you for the quick answer! Apparently using AppCheck in debug is very difficult, so I guess we'll try to use it in production environment only.
I've built a signed release apk and installed it in my Android cellphone, then upon starting it, it activated and ran the getToken() method, but with no success, the same error appears: App attestation failed.

Is it possible I am missing some step? According to SafetyNets docs, I must obtain an "Android Device Verification API Key" from Google API Console in order to request the signed certificate from SafetyNet API (which I believe is done internally by RN Firebase when I activate it?), but I haven't seen in the RNFirebase docs that I must provide an API key or seen any param to do so.

[mikehardy]

Once you have done these things https://firebase.google.com/docs/app-check/android/safetynet-provider?authuser=0#project-setup it should just work
When I was wrapping the APIs here I tested on a real device in non-enforcing mode and I successfully worked. You may need to enable the DeviceCheck API in google cloud console - this may have bearing https://stackoverflow.com/questions/64656208/what-are-the-exact-steps-to-enable-safetynet-device-check-api-on-android

[vogdev]

@Agusfn can you please tell me where did you put this code in wish file ?
FirebaseApp.initializeApp(/*context=*/ this); FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance(); firebaseAppCheck.installAppCheckProviderFactory( SafetyNetAppCheckProviderFactory.getInstance());
https://firebase.google.com/docs/app-check/android/safetynet-provider?authuser=0#initialize

[RyanMan56]

Just to add to this, if you're struggling to get this working on an Android release build make sure you generate a build signed with the same Keystore that you generated your SHA-256 certificate fingerprint with. Otherwise, release build or not, your app won't be able to authenticate with SafetyNet.

[RyanMan56]

And then at the start of your app all you'll need to do to activate AppCheck is:

import {firebase} from '@react-native-firebase/app-check';

firebase.appCheck().activate('ignored', false);

[bimix]

this is what I have been searching for days already! Remember to use the same SHA-256 .

[glesperance]

I am trying to implementing a PoC of a debug app working with a configured token based on the changes @mikehardy mentioned

In MainApplication.java I have:

@Override
public void onCreate() {
  super.onCreate();
  
  try {
    Class<?> testHelperClass = DebugAppCheckTestHelper.class;
    Method[] methods = testHelperClass.getDeclaredMethods();
    for (int i = 0; i < methods.length; i++) {
      if (methods[i].getName().equals("fromString")) {
        Method testHelperMethod = methods[i];
        testHelperMethod.setAccessible(true);
        DebugAppCheckTestHelper debugAppCheckTestHelper = 
          (DebugAppCheckTestHelper)testHelperMethod.invoke(null, "DAAAD270-B649-4846-B665-F11A7B36EC11");
        debugAppCheckTestHelper.withDebugProvider(() -> {

          ReactNativeFirebaseApp.initializeSecondaryApp("secondaryFromNative", getApplicationContext());
  
          FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance(FirebaseApp.getInstance("secondaryFromNative"));
          firebaseAppCheck.installAppCheckProviderFactory(
              DebugAppCheckProviderFactory.getInstance());
        });
      }
    }
  } catch (Exception e) {
    throw new RuntimeException("Unable to force AppCheck debug token: ", e);
  }
  

  SoLoader.init(this, /* native exopackage */ false);
  initializeFlipper(this, getReactNativeHost().getReactInstanceManager());
}

In build.gradle I have added:

dependencies {
...
    implementation 'com.google.firebase:firebase-appcheck-debug:16.0.0-beta02'
+   implementation 'com.google.firebase:firebase-appcheck-debug-testing:16.0.0-beta02'
}

And in my React App I do:

try {
  let firebase = getFirebaseRoot()
  let app = firebase.app("secondaryFromNative")
  await appCheck(app).activate("ignored", true)
} catch (e) {
  console.log("Failed to initialize appCheck:", e)
}

try {
  let firebase = getFirebaseRoot()
  let app = firebase.app("secondaryFromNative")
  await firestore(app)
    .collection("users")
    .set({ "name": "Hello world" }, { merge: true })
} catch (e) {
  console.log("xxx Error: couldn't update user document", e)
}

I have also added generated debug token in the firebase console.

---

This is however still not working as I keep getting a permission denied error:

xxx Error: couldn't update user document [Error: [firestore/permission-denied] The caller does not have permission to execute the specified operation.]

Which I can confirm is a AppCheck error since I can see it in the analytics.

I am honestly not sure where to go from here so if anyone has a pointer, that would be much appreciated.

[mikehardy]

wow - it looks like you have done everything, and that includes the awful stuff you have to do right now in the android native code for the android debug provider.

I'm not sure about the "secondaryFromNative" stuff - are you sure you need to do that? Only asking because it is possibly valid but it is a variation from what we do. Also I wasn't sure AppCheck supported multiple apps but now that I check, it does seem to https://firebase.google.com/docs/reference/android/com/google/firebase/appcheck/FirebaseAppCheck#public-static-firebaseappcheck-getinstance-firebaseapp-firebaseapp - though I haven't tested that as thoroughly. Could be something wrong there.

Also maybe useful, maybe not useful, when I get firestore/permission-denied that's normally firebase rules - I assume you checked that, but maybe that's the actual root cause here? In my testing I had app check set to the "middle" mode where it would give me stats on whether hits to firestore etc had valid tokens, but it wouldn't actually deny them. The shared app check token set up was pretty important for that before it recognized the debug token.

Also note that your debug token is now in the wild (similar to react-native-firebase's...) so make sure you either don't care about that (we don't, here) or you rotate it if it's actually guarding precious resources.

Deeper log analysis via adb logcat may prove interesting? Unknown there

[glesperance]

Ok so progress: it seems you are right about using a "secondary app from native" causing inconsistencies.

However, my problem now is that creating a "secondary app from native" is the only way I can imagine to get the RNFirebase to (maybe) pick up the "DAAAD270-B649-4846-B665-F11A7B36EC11" token.

(Btw thank you for the reminder, I will make sure to invalidate the token once this is figured out)

I've tried this:

try {
      Class<?> testHelperClass = DebugAppCheckTestHelper.class;
      Method[] methods = testHelperClass.getDeclaredMethods();
      for (int i = 0; i < methods.length; i++) {
        if (methods[i].getName().equals("fromString")) {
          Method testHelperMethod = methods[i];
          testHelperMethod.setAccessible(true);
          DebugAppCheckTestHelper debugAppCheckTestHelper = 
            (DebugAppCheckTestHelper)testHelperMethod.invoke(null, "DAAAD270-B649-4846-B665-F11A7B36EC11");
          debugAppCheckTestHelper.withDebugProvider(() -> {

            // ReactNativeFirebaseApp.initializeSecondaryApp("secondaryFromNative", getApplicationContext());
            // FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance(FirebaseApp.getInstance("secondaryFromNative"));
            // firebaseAppCheck.installAppCheckProviderFactory(
            //     DebugAppCheckProviderFactory.getInstance());

            FirebaseApp.initializeApp(/*context=*/ this);
            FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
            firebaseAppCheck.installAppCheckProviderFactory(DebugAppCheckProviderFactory.getInstance());
          });
        }
      }
    } catch (Exception e) {
      throw new RuntimeException("Unable to force AppCheck debug token: ", e);
    }

but my feeling is that debugAppCheckTestHelper.withDebugProvider(() -> {...}) has no effect on the actual FirebaseApp used from within react-native-firebase.

Any idea of how I could "wrap" the react-native-firebase module loading within debugAppCheckTestHelper.withDebugProvider(() -> {...})?

[mikehardy]

Sorry I do not know - you are now on the leading edge of AppCheck implementations globally I think...

[glesperance]

@mikehardy So it turns out there was quite an elegant solution that could be implemented.

I've illustrated this in details in a separate branch[1] but here is the summary of the solution:

1. By default, the behaviour is the same as what we have right now -- that is default to use the DebugAppCheckProviderFactory.
2. If a FIREBASE_APP_CHECK_DEBUG_TOKEN env var is provided and we're in debug mode -- use that instead of the default.
3. If not in debug mode, use the SafetyNetAppCheckProviderFactory

I believe this could be worth a PR, but before I go ahead, I'd like to get your thoughts on the implementation.

Cheers!

[1] glesperance@43b1a05

[mikehardy]

That does look good, i like env var injection for this purpose, fits a 12factor app style. Please post a PR if you get a chance. Extra credit if you switch the e2e harness to this style 😅. For spacing, if there are spacing changes best to use npm package google-java-format and do a separate commit so functional changes aren't muddled with lint changes, but none of that is blocker vs actually improving things

[glesperance]

@mikehardy do you have documentation on how to run the e2e tests? I keep running in the following error:

gabriel@mt react-native-firebase % yarn tests:android:test
yarn run v1.22.15
$ cd tests && yarn detox test --configuration android.emu.debug
$ /Users/gabriel/Workspace/react-native-firebase/tests/node_modules/.bin/detox test --configuration android.emu.debug
detox[10888] INFO:  [test.js] mocha --config e2e/.mocharc.js --configuration android.emu.debug --grep :ios: --invert --use-custom-logger true e2e
detox[10889] ERROR: at node_modules/jet/lib/node/ws.js:18:11
 [✈️] connection unsuccessful. This is most likely due to a bundling error on your packager or your packager is not running.
detox[10888] ERROR: [cli.js] Command failed: mocha --config e2e/.mocharc.js --configuration android.emu.debug --grep :ios: --invert --use-custom-logger true e2e

[mikehardy]

There are a few steps - it looks like you need another terminal and yarn tests:packager:jet running in it. Don't forget yarn tests:emulator:start either, to get the local firebase emulator going. And of course prior to running yarn tests:android:test you have to do yarn tests:android:build but it appears you already did that. Should work?

[glesperance]

Thanks for all the (timely) help @mikehardy! Here's the PR #6026.

Cheers!

[bleedingAyush]

My app check is working fine. But when i try to get the token as suggested by @RyanMan56 it shows undefined without any errors.
All the react-native-firebase packages are of version 13.1.1.
Okay, Sorry I found out the solution I was doing a silly mistake.
Instead of getting the token by adding a *.token after the result like

firebase
  .appCheck()
  .getToken(true)
  .then((res) => {
    
    console.log("result", res.token);
  })
  .catch((err) => {
  });

change res.token to res