2

I recently integrated Firebase App Check in my app and enforced it for calling Cloud Functions. The problem is that everything works fine on my OnePlus 8T whereas the calls to cloud function fails on all other devices. I am installing the app from Google Play Store (Uploaded to Internal Testing) on all the devices.

The following error message is shown in the cloud functions logs:

errorInfo:
   { code: 'app-check/invalid-argument',
     message: 'Decoding App Check token failed. Make sure you passed the entire string JWT which represents the Firebase App Check token.' },
     codePrefix: 'app-check' 
   }

The list of Firebase dependencies that are being used are as follows:

    implementation platform('com.google.firebase:firebase-bom:28.4.0')
    implementation 'com.google.firebase:firebase-appcheck-safetynet:16.0.0-beta02'
    implementation 'com.google.firebase:firebase-analytics-ktx'
    implementation 'com.google.firebase:firebase-messaging'
    implementation 'com.google.firebase:firebase-crashlytics-ktx'
    implementation 'com.google.firebase:firebase-functions-ktx'
    implementation 'com.google.firebase:firebase-config-ktx'

The Firebase App Check is initialized in the Application class as follows:

private fun initFirebaseAppCheck() {
        FirebaseApp.initializeApp(this)
        appCheck.installAppCheckProviderFactory(SafetyNetAppCheckProviderFactory.getInstance())
    }

Code of the Cloud Function that is being called

import * as functions from "firebase-functions";
import vision from "@google-cloud/vision";

const client = new vision.ImageAnnotatorClient();

export const fetchData = functions.https.onCall(async (data, context) => {
 
  if (context.app == undefined) {
    throw new functions.https.HttpsError(
        'failed-precondition',
        'The function must be called from an App Check verified app.')
  }

  // Function Logic here
});

Log when the app is run on OnePlus 8T

Callable request verification passed {"verifications":{"auth":"MISSING","app":"VALID"}}

I don't know why the Firebase App Check is passing on only one device and failing on all the other devices. Any help will be appreciated.

Mehul Kanzariya
  • 888
  • 3
  • 27
  • 58
  • *Firebaser here.* [SafetyNet](https://developer.android.com/training/safetynet/attestation) is a standalone product that assesses the device your app is running on as part of your abuse detection system. App Check exchanges the returned SafetyNet token for an App Check token (if the contained assessment indicates that your device is safe) that can then be used to let your app access your Firebase resources. Note that App Check also requires that your app's SHA256 certificate fingerprint matches the one inside the SafetyNet assessment, so please check that as well. – Victor Fan Sep 02 '21 at 18:51

0 Answers0